The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes a shell script directly from GitHub using a piped-to-shell pattern.
Evidence: Found in SKILL.md in the 'Apply' step: curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --update.
Context: The source repository matches the author's (mikefluff) namespace, indicating this is a vendor-native update mechanism rather than an external dependency.
[COMMAND_EXECUTION]: The skill executes local shell commands to manage versioning and trigger the update process.
Evidence: Pipeline steps in SKILL.md utilize jq, grep, and sed to parse local marker files and determine the current installation state.
[EXTERNAL_DOWNLOADS]: The skill fetches release information and documentation from external GitHub endpoints.
Evidence: Uses WebFetch to access api.github.com/repos/Mikefluff/skills/releases/latest and raw.githubusercontent.com/Mikefluff/skills/main/CHANGELOG.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays external content (changelogs) which could potentially contain malicious instructions if the source repository were compromised.
Ingestion points: Fetches CHANGELOG.md via WebFetch in SKILL.md.
Boundary markers: None explicitly mentioned for the changelog text display.
Capability inventory: The skill has Bash and WebFetch capabilities enabling code execution and network access.
Sanitization: No specific filtering or sanitization of the changelog content is described before it is shown to the user or processed by the agent.

skills-update