The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches npm distribution tags from registry.npmjs.org and performs a sparse clone of the official deepseek-ai/deepseek-harness repository to retrieve upgrade documentation. These operations target well-known and official vendor sources.
[DYNAMIC_EXECUTION]:
Uses import() in scripts/quick-smoke.mjs to dynamically load and execute the entry point of a local plugin for validation purposes. This executes external code within the tool's process.
Executes npm run typecheck or pnpm run typecheck in the target plugin directory via scripts/run.mjs, which runs arbitrary scripts defined in the target's package.json.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads and scans source files from arbitrary user-provided directories (via code-scan.mjs and plugin-audit.mjs).
Boundary markers: Outputs analysis findings as structured JSON or plain text summaries for the agent.
Capability inventory: Includes file system modification (fs.renameSync in env-heal.mjs), subprocess execution, and dynamic module loading.
Sanitization: Implements a custom lexical state machine in scripts/lib/scanner.mjs to separate code from comments and strings during scanning, reducing the risk of accidental instruction obedience.
[COMMAND_EXECUTION]: Runs system commands such as ps to identify active DSH processes and git for repository management, which are necessary for environment diagnostics.

plugin-fast-adapt