The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/artifact_io.py utilizes subprocess.run to invoke curl for API communications. The implementation follows security best practices by passing arguments as a list to prevent shell injection and providing sensitive authorization tokens through curl's configuration input via stdin to avoid exposing secrets in the system process table.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to link.octavehq.com, which is the vendor's own infrastructure. These operations include downloading asset bundles and metadata. The code performs integrity verification using SHA256 checksums and file size checks as specified in the service manifest.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from the filesystem (during upload) and from the remote service (during list/get operations). The potential for injection is mitigated by strict JSON serialization, validation of all identifiers, and comprehensive path checks (checked_path) that prevent directory traversal and symlink attacks.
[SAFE]: Overall, the skill exhibits high security standards. It uses atomic file replacement strategies for downloads and enforces strict manifest-based controls for public uploads, ensuring that only intended files are exposed.

asset-manager