The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches installation and configuration scripts for common development tools and runtimes.
Evidence: References to https://get.pnpm.io/install.sh, https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh, https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh, and https://pyenv.run found in SKILL.md and references/setup-checklist.md.
Context: These are the official distribution points for widely-used developer tools like pnpm, Homebrew, nvm, and pyenv.
[REMOTE_CODE_EXECUTION]: Onboarding instructions include commands that download and execute scripts to automate environment configuration.
Evidence: Commands like curl -fsSL https://get.pnpm.io/install.sh | sh and bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" found in SKILL.md.
Context: This is the standard installation pattern recommended by the tool authors for these specific utilities.
[COMMAND_EXECUTION]: Generates executable setup scripts that use elevated privileges and system utilities.
Evidence: Use of sudo apt install, sudo ./aws/install, and docker compose up in references/onboarding-templates.md and references/setup-checklist.md.
Context: These commands are used to install system-level dependencies and start local dev services (PostgreSQL, Redis), which is expected behavior for an environment setup skill.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection due to its requirement for untrusted project data.
Ingestion points: Untrusted data enters via user-provided repository URLs and project technology stack details in SKILL.md.
Boundary markers: Absent; the skill does not explicitly use delimiters for interpolated user input.
Capability inventory: The skill allows for repository cloning, dependency installation, and script execution across all documentation and template files.
Sanitization: Absent; the instructions do not specify validation or filtering for user-supplied project metadata.

core-onboarding