The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a marketplace.json file and a ZIP archive containing skill packages from the vendor's official GitHub repository (matematicsolutions/awesome-matematic-skills-pl). This is a legitimate operation for a marketplace installer and utilizes a well-known service.
[COMMAND_EXECUTION]: The skill generates a Windows batch script (.bat) and includes a PowerShell script (write-skills-lock.ps1) to manage the installation process. The generated script executes PowerShell commands like Invoke-WebRequest and Expand-Archive to download and unzip files into the user's local Claude Code skills directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a remote marketplace.json file to identify available skills. This represents a potential ingestion point for external data, which is mitigated by the trusted nature of the source and the requirement for human approval before installation.
Ingestion points: .claude-plugin/marketplace.json fetched from the awesome-matematic-skills-pl repository.
Boundary markers: None explicitly implemented in the prompt templates.
Capability inventory: Bash and Write tools are utilized to create the installation and instruction files.
Sanitization: The skill performs placeholder substitution for Git references and skill slugs derived from the marketplace manifest.

matematic-marketplace-installer