The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the apic-mcp-server repository from https://github.com/ibm-apiconnect/apic-mcp-server.git and agent skills from https://github.com/ibm-apiconnect/api-studio-skills/tree/develop. These are official vendor resources used to populate the local environment.
[REMOTE_CODE_EXECUTION]: The skill performs remote package installations and script executions using npm i -g @apistudio/apim-cli@latest and npx -y skills add from the vendor's GitHub repository. These actions are standard initialization steps for the IBM API Connect MCP ecosystem.
[COMMAND_EXECUTION]: The skill executes multiple shell and PowerShell commands to manage the filesystem (mkdir, New-Item), handle git operations (git clone, git sparse-checkout), and validate local JSON configurations.
[CREDENTIALS_UNSAFE]: The skill collects sensitive information including API_KEY, client_secret, and STANDALONE_PASSWORD. The instructions require the agent to prompt for these values one at a time and store them in a local .bob/mcp.json file for MCP server authentication. Best practices are followed by explicitly instructing the agent not to log or echo these secrets.
[PRIVILEGE_ESCALATION]: The skill suggests using sudo apt-get install or sudo yum install to upgrade Git if the local version is outdated. It also performs global Node.js package installations using npm i -g, which typically requires administrative permissions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided input such as platform URLs, organization names, and credentials to populate the MCP configuration file.
Ingestion points: Collected through interactive prompts in idig-apic.md and idig-onprem.md.
Boundary markers: The agent is instructed to validate that URLs start with http:// or https:// and that string values are non-empty.
Capability inventory: The skill has access to the filesystem, network (via git/npm), and command execution.
Sanitization: Input is validated for basic format (URL prefix) before being written into a structured JSON configuration.
[DYNAMIC_EXECUTION]: The skill dynamically generates a .bob/mcp.json configuration file that defines how MCP servers are executed, including passing local .tgz package paths and user-provided environment variables to the npx command.

init-apic-ai-assets