The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches external registry data and candidate skill files from GitHub repositories to perform surveys and evaluations. These downloads target well-known services and are used exclusively for discovery and analysis purposes.
[COMMAND_EXECUTION]: Executes shell commands including curl and grep to parse registry lists, and utilizes CLI tools like apm and npx @mizchi/waxa to install, audit, and evaluate candidate skills. These operations are within the scope of the skill's primary management and testing functions.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for indirect prompt injection, as it is designed to read and evaluate untrusted content from external repositories.
Ingestion points: SKILL.md workflow steps 2 (sweep), 4 (audit), and 5 (eval gate) read external READMEs and SKILL.md files.
Boundary markers: The instructions do not define specific delimiters for separating untrusted external content from systemic instructions during analysis.
Capability inventory: Commands used include curl (network read), apm (file system modification/installation), and npx (tool execution).
Sanitization: No specific sanitization or filtering of external skill content is performed before interpolation into agent prompts, though the mandatory 'waxa' evaluation acts as a behavioral validation gate.

skill-finder