The Agent Skills Directory

[SAFE]: The skill is primarily a knowledge-based reference for building agent skills. It follows established best practices for documentation and structure.
[EXTERNAL_DOWNLOADS]: The scripts/update.sh maintainer tool performs network requests using curl to https://howborisusesclaudecode.com/api/install-thariq. This is documented as a mechanism for syncing the 'vendor' baseline with the upstream source (a blog post referenced in the skill). This is a standard maintainer-facing sync pattern and does not run automatically for regular users.
[COMMAND_EXECUTION]: The skill contains maintainer scripts (scripts/update.sh) intended for development workflows. These scripts perform safe operations like hashing files (sha256sum), reading frontmatter (awk), and updating metadata via sed. All commands are scoped to the plugin directory.
[PROMPT_INJECTION]: The skill mentions and provides guidance on the !command (dynamic context) syntax. While this syntax can be used for injection if misused, the skill itself uses it defensively, documenting 'Defensive fallback is mandatory' and providing examples like !git status || echo "(git status unavailable)". This represents best-practice guidance rather than a malicious pattern.

skill-authoring