The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for installing third-party code using the command npx skills-installer install @owner/repo/skill-name. This facilitates the download and execution of arbitrary code from the npm registry based on remote API results.
[COMMAND_EXECUTION]: The skill involves the execution of shell commands including curl for API interaction and npx for software installation and management tasks such as list and uninstall.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch metadata from https://claude-plugins.dev/api/skills and triggers downloads of packages from the npm registry via the npx command.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and display data from an external API, creating a surface for indirect prompt injection if the remote data contains malicious instructions.
Ingestion points: The agent processes JSON results from https://claude-plugins.dev/api/skills inside SKILL.md.
Boundary markers: Absent. There are no instructions to ignore or delimit potentially malicious content within the search results.
Capability inventory: The skill has the ability to execute shell commands (curl, npx) and modify the local environment through plugin installation.
Sanitization: Absent. The instructions do not specify any validation or sanitization of the data returned from the registry API.

skills-discovery