The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute various commands, including a complex shell script in Step 0 and multiple calls to the mthds-agent CLI tool for linting and validation.
[DYNAMIC_EXECUTION]: In Step 0, the skill executes a script (mthds-env-check) located at a path computed at runtime. It searches the $HOME/.claude/plugins/cache/ directory using globbing and version-sorting logic to find and run the 'best' version of the executable.
[EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the mthds package via npm install -g mthds if the environment check fails. This involves downloading and installing third-party code from the npm registry at runtime.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it reads and processes untrusted .mthds files provided by the user.
Ingestion points: The skill reads .mthds files in Step 1 using the Read tool.
Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded within the bundle files.
Capability inventory: The skill has access to Bash (command execution), Read, Grep, and Glob tools, which could be leveraged if an injection is successful.
Sanitization: The skill relies on the external mthds-agent CLI for validation, but the agent also manually reviews the content in Step 6.

mthds-check