The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external manifests provided via 'skills-hub://' URLs. This represents an attack surface where a maliciously crafted manifest could attempt to influence agent behavior.
Ingestion points: The 'manifest' query parameter in 'skills-hub://install' links is decoded as JSON data (SKILL.md).
Boundary markers: The skill includes rigorous validation rules, including length limits (30,000 characters), specific field requirements (version 'v: 1', title length), and strict character/format constraints for repository and path segments. It explicitly instructs the agent to never execute the manifest content.
Capability inventory: The skill can execute the 'skillshub-cli' to perform installations, deployments, and tag management across various agent environments (Codex, Claude Code, Cursor, etc.).
Sanitization: The instructions mandate decoding the query value once as JSON and performing field-level validation using regex and exclusion lists (e.g., forbidding '..', backslashes, and specific file endings).
[COMMAND_EXECUTION]: The skill is designed to locate and execute a local binary named 'skillshub-cli'. To mitigate risks associated with executing local binaries, the skill mandates a strict verification workflow.
Evidence: The agent must verify the binary's SHA-256 hash against a local '.sha256' stamp file and confirm the version output matches a '.version' stamp file before binding the path to an execution variable. Fallback to the system PATH only occurs if the dedicated desktop bridge directory is absent.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party agent skills from GitHub repositories using the 'skills install' command.
Evidence: The skill supports installing from 'owner/repo' shorthands or full GitHub URLs, specifically encouraging the use of 40-character hexadecimal commit SHAs for version pinning.

manage-skills-hub