The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses shell execution placeholders (!command) within SKILL.md to perform environment checks at load time. Specifically, it executes npm list commands to determine if the exa-js SDK or competing search providers are currently installed. These are diagnostic in nature and do not access sensitive files or perform network exfiltration.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to install the exa-js package via npm install. This is the official client library for the Exa neural search service, which is a well-known AI search provider, and is consistent with the skill's stated purpose of facilitating migration.
[INDIRECT_PROMPT_INJECTION]: The skill documents code patterns for ingesting untrusted data from external search results via the exa.searchAndContents API.
Ingestion points: Data enters the agent's context through search results (highlights and text fields) as shown in the ExaSearchAdapter implementation in SKILL.md.
Boundary markers: None are present in the provided code snippets to delimit the external search content from instructions.
Capability inventory: The skill environment allows for Bash(npm:*) and Bash(node:*) execution, as well as file Read, Write, and Edit operations.
Sanitization: The adapter code uses substring(0, 300) for basic length truncation, but does not perform escaping or instruction filtering on the retrieved content.

exa-migration-deep-dive