The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the latest version of the skills package from the npm registry. It also uses gh api to verify repository contents on GitHub. These are standard developer tools and targeted at public, expected sources.
[COMMAND_EXECUTION]: The skill executes various shell commands including pnpm, npm, npx, gh, and jq. These commands are used for dependency management and repository state verification (e.g., pnpm skills:install, gh api "repos/${source}/contents/${skill_path}").
[SAFE]: The instructions explicitly include npm_config_ignore_scripts=true when running npx commands. This is a security best practice that prevents the execution of arbitrary lifecycle scripts within the downloaded packages, mitigating risk during the installation phase.

install-skills