The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates skill management by executing the pinned upstream utility skills@1.5.14 via npx.
Shell commands are constructed using argument arrays (via tinyexec) rather than string concatenation, which effectively prevents shell injection vulnerabilities.
Sequential execution and lockfile diffing are used to discover resolved skill names securely after installation.
[EXTERNAL_DOWNLOADS]: The add command fetches JSON manifest files from remote HTTPS URLs.
The fetch logic enforces security bounds, including a 1 MiB response cap, a limit of five redirects, and strict HTTPS requirements.
Redirection is restricted to authorized hosts or the original host to prevent unintended host-hopping.
The utility uses an allowlist for known providers (skill-set.md, skill-sets.md) and prompts for explicit user confirmation before connecting to any unknown third-party host.
[SAFE]: The skill includes a robust integrity verification system using SHA-256 hashes.
It allows users to verify downloaded content against author-published locks or out-of-band hashes provided in URL fragments (e.g., #sha256=...).
Error reporting is specifically designed to avoid echoing untrusted remote content (like manifest keys or malformed JSON snippets) into the terminal or logs, mitigating potential injection vectors through error surfaces.

skill-sets