The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/refresh_forgejo_api_docs.py is designed to download a Swagger/OpenAPI JSON specification from a remote URL provided via the --source-url argument or the FORGEJO_SWAGGER_URL environment variable. This uses the urllib.request.urlopen method to fetch external data into the local environment.
[COMMAND_EXECUTION]: The skill provides numerous templates and instructions for the agent to construct and execute curl commands. These commands are intended to interact with a Forgejo instance and include sensitive operations such as creating repositories, managing Actions secrets, and performing administrative tasks via the Sudo header.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests and processes untrusted external data (API specifications) to generate local documentation and influence agent behavior.
Ingestion points: scripts/refresh_forgejo_api_docs.py fetches the swagger.v1.json file from a remote host.
Boundary markers: The generated markdown files in references/tags/ and references/overview.md lack explicit delimiters or instructions to ignore potentially malicious content embedded in the API summaries or descriptions.
Capability inventory: The skill allows the agent to generate and execute curl commands, write files to the references/ directory, and query the local API snapshot using scripts/query_forgejo_api.py.
Sanitization: The scripts perform standard JSON parsing and use regex-based slugifying for tag names, but they do not perform deep sanitization of the natural language fields (summaries, descriptions) within the API specification.

forgejo-api