The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local commands to manage the host environment, including duoduo daemon status/restart, npm install, and gh issue create. These commands are integral to the skill's primary purpose of host administration and lifecycle management.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of core updates and additional skill modules from official vendor sources.
Evidence: npm install -g @openduo/duoduo@latest and npx -y skills add https://github.com/openduo/duoduo --global --all are used to keep the system up to date. These references target the vendor's official GitHub and npm registries.
[INDIRECT_PROMPT_INJECTION]: The skill processes configuration files that may contain instructions influencing agent behavior, creating a potential surface for indirect injection.
Ingestion points: The agent reads kernel/config/<kind>.md and descriptor.md files which store per-channel prompts and overrides. It also ingests local script output via bash scripts/v05-upgrade-preflight.sh.
Boundary markers: The skill instructions emphasize treating the daemon config as the source of truth and explicitly distinguishing between user configuration and system behavior.
Capability inventory: The skill has the ability to execute shell commands, manage system processes (daemons), and write to environment files (.env).
Sanitization: The instructions include a dedicated playbook for public issue reporting (references/issue-reporting.md) that explicitly forbids leaking private source code, file paths, or credentials, mitigating data exposure risks.

duoduo-admin