The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download the alignfirst package from the NPM registry. This package belongs to the skill's author (Paleo) as indicated in the metadata and repository fields.
[REMOTE_CODE_EXECUTION]: The instruction to run npx -y alignfirst guide merge results in the execution of remote code fetched from the NPM registry at runtime. As the package is a known resource from the vendor, this is standard tool behavior.
[COMMAND_EXECUTION]: The skill executes a shell command to retrieve instructions, which is a standard operation for developer-oriented skills.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to follow instructions contained within the output of the alignfirst command. This establishes a surface where external content could influence the agent's logic.
Ingestion points: Output of npx -y alignfirst guide merge in SKILL.md.
Boundary markers: None.
Capability inventory: The agent is tasked with following the protocol guide and work file rules provided by the command.
Sanitization: None.

almerge