The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches SDK components, documentation, and source code from vendor-controlled resources, including github.com/greedy-co/abto-sdk.git, docs.abto.app, and official package registries (NPM, PyPI, Maven).
[COMMAND_EXECUTION]: The skill guides the agent to execute standard development tools and package managers—such as npm, pnpm, yarn, pip, dart, gradle, and swift—to install dependencies and verify the integration through build and test suites.
[DATA_EXFILTRATION]: The skill is designed to transmit trace identifiers, device IDs, and event telemetry to the vendor's endpoints (api.abto.app and gateway.abto.app). This behavior is the primary stated purpose of the integration and is documented as opt-in for business events.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes repository metadata, workspace manifests, and source code to identify model call sites, representing a surface for indirect prompt injection from untrusted project files.
Ingestion points: Reads repository instructions, Git roots, workspace manifests, lockfiles, and application source code (SKILL.md, references/discovery-and-reporting.md).
Boundary markers: Implements a strict three-section output structure and requires explicit user confirmation at multiple checkpoints before modifying code (SKILL.md, references/verification.md).
Capability inventory: Performs file system writes, package installations, and network requests to vendor domains across all supported runtimes (references/browser-javascript.md, references/server.md).
Sanitization: Includes explicit instructions to redact credentials from URLs and to use sanitized minimal operations when reproducing suspected SDK defects (references/sdk-defect-handling.md, references/server.md).

abto