The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches Language Server Protocol implementations and related tooling from well-known sources.
Sources include official project domains (eclipse.org, llvm.org, swift.org, dot.net), GitHub releases (kotlin-language-server, lua-language-server), and standard package registries (NPM, PyPI, RubyGems).
These downloads are for standard development tools necessary for the skill's stated purpose of providing code intelligence.
[COMMAND_EXECUTION]: Executes shell commands to install and verify development tools.
Uses various package managers such as npm, pip, brew, go install, rustup, gem, apt, and dnf to install binaries.
Runs verification commands like which and where.exe to ensure successful installation.
Modifies configuration files in the user's home directory (~/.copilot/lsp-config.json) and the project repository (.github/lsp.json).
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for processing untrusted data during configuration merging and web searches.
Ingestion points: Reads existing JSON configuration files from ~/.copilot/lsp-config.json and .github/lsp.json. It also suggests searching the web for unknown language servers.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when reading existing configuration files.
Capability inventory: Possesses capabilities to write to the file system, execute package installation commands, and run shell binaries.
Sanitization: The instructions do not specify explicit validation or sanitization steps for the data read from existing configuration files before it is merged and used.

lsp-setup