The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a production CLI installer from a vendor-controlled domain (nvidia.github.io). This is a standard functional requirement for verifying the production deployment path.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded installer script using bash. Security is maintained via a cryptographic integrity check where the downloaded file's SHA-256 hash is verified against a local source-of-truth file before any execution occurs.
[COMMAND_EXECUTION]: Toolchain commands including pnpm, git, and uv are executed via node:child_process.spawn. The skill mitigates risks by resolving these binaries to absolute paths and executing them within a restricted tool-bin environment to prevent path injection.
[DYNAMIC_EXECUTION]: The script dynamically generates shell shims for npm and npx within a temporary directory. This ensures consistent tool behavior within the isolated environment and is restricted to the lifetime of the verification run.
[INDIRECT_PROMPT_INJECTION]: The skill parses logs and standard output from generated projects to identify failure signatures using regular expressions. While this involves processing external data, the ingestion is used solely for status reporting and does not influence the agent's core instruction set.
[SAFE]: Extensive safety controls are implemented, including isUnsafeRunDirectory checks to prevent destructive operations within the repository checkout and the use of isolated HOME, TMPDIR, and cache directories to ensure side-effect-free execution.

agent-starters