The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The install.sh script fetches several installer scripts from the vendor's official domains:
https://goldsky.com (Goldsky base CLI installer)
https://compose.goldsky.com/install (Compose component installer)
https://install-turbo.goldsky.com (Turbo component installer)
[REMOTE_CODE_EXECUTION]: The skill executes the scripts downloaded from the vendor's domains using bash and sh to perform the installation. This is the intended purpose of the setup skill.
[COMMAND_EXECUTION]: The skill executes various local commands for environment setup and verification:
Shell scripts: scripts/install.sh and scripts/install.ps1 (which invokes wsl.exe).
CLI tool operations: goldsky login, goldsky project list, and version checks for goldsky, compose, and turbo.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes data from external sources:
Ingestion points: CLI output from goldsky project list is used to determine project names and IDs.
Boundary markers: Not explicitly present in the data ingestion step, though the output is expected to be a standard table format.
Capability inventory: The skill can execute shell commands, perform network downloads, and write files to the home directory via the installation scripts.
Sanitization: The skill does not explicitly sanitize the CLI output before summarizing it for the user, though the risk is low as the data comes from the user's own authenticated account.

auth-setup