The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local scripts (upstream-version, currently-loaded-version, and marketplace-name) using Bash and PowerShell to identify the environment and current plugin version.
Evidence: SKILL.md contains instructions to run bash "${CLAUDE_SKILL_DIR}/scripts/..." and powershell.exe -ExecutionPolicy Bypass -File "${CLAUDE_SKILL_DIR}/scripts/...".
[EXTERNAL_DOWNLOADS]: The skill fetches the latest version metadata from the vendor's official GitHub repository using the GitHub CLI (gh).
Evidence: scripts/upstream-version.sh executes gh api repos/raptoravis/tunan/contents/plugins/.claude-plugin/plugin.json to retrieve the current version field.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API (GitHub) which is then used to influence the agent's response to the user.
Ingestion points: Data enters the context from the gh api call in scripts/upstream-version.sh and scripts/upstream-version.ps1.
Boundary markers: None; the output of the script is used directly in the decision logic described in SKILL.md.
Capability inventory: The skill has the capability to run predefined local scripts via the Bash tool but does not possess arbitrary file-write or network exfiltration capabilities beyond the specific version check.
Sanitization: The scripts use jq to specifically extract the .version field from the JSON response, providing a layer of structural validation.

update