The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell executions using git to verify repository status, npx skills to check and update tracked packages, and a bundled Python script for local content synchronization. These operations are restricted to the skill's administrative scope.\n- [EXTERNAL_DOWNLOADS]: External content is retrieved via the npx skills CLI from GitHub repositories. This process is governed by local lock files containing content hashes to ensure integrity.\n- [DATA_EXPOSURE]: The skill audits skill installations by reading metadata from .skill-lock.json and scanning directory structures in standard locations like ~/.agents and ~/.claude. Access is limited to skill-related configuration and content.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from scanned skill folders to generate status reports. It mitigates potential injection risks by using structured reporting formats and requiring explicit user confirmation before executing update actions based on the scan results.

skill-updater