The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a capability catalog from https://basic-anteater-667.convex.site/capabilities.json. This domain is a user-generated subdomain on the Convex hosting platform, not an official vendor domain or a recognized trusted source.
[REMOTE_CODE_EXECUTION]: The workflow instructs the agent to fetch remote Markdown files (e.g., /capability/<id>.md) and "follow its Procedure+Rules sections." This pattern allows a remote server to provide instructions, including shell commands or script logic, that the agent will execute dynamically.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Data is ingested from remote JSON and Markdown files hosted at https://basic-anteater-667.convex.site.
Boundary markers: None. The skill does not provide delimiters or instructions for the agent to distinguish between the fetched data and authoritative commands.
Capability inventory: The skill explicitly references availability of curl and bash in the environment, along with the ability to run local scripts such as /add-hosting and /add-component.
Sanitization: No validation or sanitization is performed on the remote content; the skill relies solely on the agent's "normal judgment."
[DYNAMIC_EXECUTION]: The skill dynamically loads its core logic and procedures from an external URL during runtime rather than having static instructions, which circumvents static analysis of the skill's actual behavior.

convex-add