The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/upstream_check.py script executes system commands to perform network operations and check versions of local dependencies.
Evidence: Uses subprocess.run with curl to fetch remote content and CLI tools like pip to verify versions.
Evidence: Commands are executed as lists to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill fetches metadata and skill content from GitHub's official domains.
Evidence: Requests are made to api.github.com and raw.githubusercontent.com to compare version strings and content hashes.
[PERSISTENCE]: The skill provides instructions and templates for establishing recurring automated sync checks via system schedulers.
Evidence: Documentation and crontab templates are provided for setting up monthly automated maintenance.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub repositories and local configuration files, creating a surface for potential instruction injection.
Ingestion points: Remote SKILL.md files and the local UPSTREAM_MANIFEST.md file.
Boundary markers: None used for output reporting.
Capability inventory: Shell command execution (via curl/subprocess) and file read access.
Sanitization: Employs regex for version extraction and list-form for subprocess calls to mitigate injection risks.

skill-maintainer