The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands (rm, ln, mkdir, cp) and uses the npx skills utility to manage the installation and removal of skills. These actions are governed by the scripts sync.sh and reconcile.sh.
[EXTERNAL_DOWNLOADS]: sync.sh communicates with the GitHub API (api.github.com) to fetch the current list of skills from the author's own repository (healthier-vitamins/agentic-grimoire). This data is used to determine which locally installed skills are no longer present in the source repo. As GitHub is a well-known service and the request targets the author's repository, this is considered a standard operation.
[SAFE]: The skill implements several security best practices to mitigate risk:
Input Validation: Both sync.sh and reconcile.sh use a strict whitelist regex ([a-z0-9-]+) to validate skill names before they are used in filesystem operations or shell commands, effectively preventing path traversal and command injection.
Confirmation Gate: The skill requires an explicit user confirmation (Step 3) after presenting a preview of all intended changes before any destructive actions (rm) or modifications are performed.
State Verification: During the apply phase (Step 4), the skill re-validates the current state against the confirmed preview using cmp and diff to ensure that the environment hasn't changed between the preview and the execution.

sync-agentic-grimoire