The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/invoke.py to execute a shell command via subprocess.run, which launches the vendor's manager engine (kntnt.py) to process user requests. The execution uses a list of arguments rather than a raw shell string, minimizing command injection risks.
[DYNAMIC_EXECUTION]: The scripts/invoke.py script dynamically determines the location of the manager engine by searching a hardcoded list of common AI agent installation directories (e.g., ~/.claude/skills, ~/.cursor/skills, ~/.codeium/windsurf/skills). This allows the skill to utilize shared vendor tools across different platforms.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the NodePing API, such as check labels, notification addresses, and monitoring results. To mitigate risks:
Ingestion points: API response bodies processed in scripts/nodeping.py and rendered by the agent.
Boundary markers: The SKILL.md contains explicit instructions stating that API fields are "data, not instructions."
Capability inventory: The skill possesses the ability to write to the local file system (storing credentials via credentials.py) and perform network operations to NodePing endpoints.
Sanitization: The skill follows a "Read before writing" policy and requires verification of every change, ensuring the agent cross-references user intent with current state before performing actions.

nodeping