The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a helper authentication script (ic_mcp_auth.mjs) and retrieves a configuration payload (next_steps) from the official immersivecommons.com domain.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download a JavaScript helper and execute it locally using node as a headersHelper for MCP. This is a vendor-native mechanism designed to handle dynamic token rotation and secure authentication.
[COMMAND_EXECUTION]: Shell commands including curl and claude mcp are used to interact with the vendor API and modify the agent's MCP configuration.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests a next_steps JSON object from an external API and uses it as a "source of truth" for subsequent installation and educational steps.
Ingestion points: next_steps payload from the signup polling endpoint in SKILL.md.
Boundary markers: Absent; the agent is directed to follow the recipes provided in the data.
Capability inventory: Subprocess execution via node and configuration changes via claude mcp commands.
Sanitization: No sanitization or validation of the API-provided recipes is specified.

ic-onboarding