The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the clawhub package from the npm registry. This is required for the skill's primary functionality of interacting with the ClawHub service.
[COMMAND_EXECUTION]: Several shell commands are provided to search, install, list, and update skills. These commands interact with the local file system at ~/.nanobot/workspace to manage skill files.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and displays data from a public registry (ClawHub). Maliciously crafted skill names or descriptions within that registry could contain instructions designed to manipulate the agent's behavior during the search or installation process.
Ingestion points: Data retrieved from the clawhub search and clawhub list commands (SKILL.md).
Boundary markers: None; the output from the CLI tools is processed directly without specific isolation or "ignore instructions" delimiters.
Capability inventory: The skill allows the agent to execute shell commands via npx and write files to the user's workspace directory.
Sanitization: The instructions do not specify any validation or sanitization for the data returned by the registry before it is presented to the agent.

clawhub