The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the nudocs CLI to perform document operations (upload, list, pull, delete). These commands are scoped to the user's requested workflow.
[EXTERNAL_DOWNLOADS]: The skill installs the @nutrient-sdk/nudocs-cli package from npm. This is a well-known service and the package is associated with the official Nudocs/PSPDFKit infrastructure, making it a safe dependency.
[CREDENTIALS_UNSAFE]: The skill manages an API key (NUDOCS_API_KEY). It correctly instructs the user to store this in an environment variable or a configuration file (~/.config/nudocs/api_key), which is standard secure practice for CLI tools.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it pulls content back from Nudocs.ai (e.g., nudocs pull).
Ingestion points: Content is fetched via nudocs pull and read by the agent.
Boundary markers: The skill instructions recommend clear document structure and hierarchy but do not explicitly mandate boundary markers for the pulled content.
Capability inventory: The skill can execute CLI commands (exec), write files (file_write), and perform network requests via the CLI.
Sanitization: There is no explicit sanitization mentioned for the content pulled from the external service. However, the risk is typical for document processing skills and the severity is low.

nudocs