The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the butler executable from https://broth.itch.zone, which is the official infrastructure for itch.io's build service.
[COMMAND_EXECUTION]: The skill uses shell commands like curl, unzip, chmod +x, and ./butler push to install and operate the publishing tool. These operations are essential for the skill's functionality.
[CREDENTIALS_UNSAFE]: The documentation identifies specific paths where sensitive credentials are stored, such as ~/.config/itch/butler_creds (Linux), ~/Library/Application Support/itch/butler_creds (macOS), and %USERPROFILE%\.config\itch\butler_creds (Windows). It also explains the use of the BUTLER_API_KEY environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for shell commands that interpolate potentially untrusted data such as project directories, game slugs, and version strings. * Ingestion points: The <user>/<game>:<channel> and <dir> variables in the butler push commands (e.g., in SKILL.md and references/butler-ci.md). * Boundary markers: No specific delimiters or safety instructions are used to prevent the agent from interpreting embedded characters in these strings as shell commands. * Capability inventory: The skill utilizes shell execution for the butler binary, curl, and file management tools. * Sanitization: There is no evidence of input validation or escaping for the variables passed to the shell commands.

itch-publish