The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use npx to install a skills package from an external repository (npx skills add <repository>/skills). This is a standard method for distributing developer tools but involves fetching code from remote sources during the setup process.
[COMMAND_EXECUTION]: The instructions require running command-line operations, specifically the mediaio version command, to verify the successful installation of the vendor's toolset on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill involves managing and aligning plugin manifests (.codex-plugin/plugin.json and .claude-plugin/plugin.json). Since the agent processes these external configuration files, they represent a potential attack surface where third-party data could influence agent behavior, although this is a typical configuration pattern for these platforms.
Ingestion points: Plugin manifest files located in the .claude-plugin/ and .codex-plugin/ directories.
Boundary markers: Absent; the instructions do not specify delimiters or warnings for the content of these manifests.
Capability inventory: The skill possesses the ability to execute shell commands via npx and the mediaio CLI.
Sanitization: No explicit sanitization or validation of the manifest content is mentioned in the instructions.

mediaio-install