The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download the da-cli source code from a third-party GitHub repository (github.com/FZ2000/da-cli.git) which is not an verified source for this vendor.- [REMOTE_CODE_EXECUTION]: Installation steps involve executing shell scripts (install.sh and install_schedule.sh) directly from the downloaded third-party repository, which could perform arbitrary actions on the host system.- [COMMAND_EXECUTION]: The skill automates the creation and loading of system-level configuration files for background services using launchd (macOS) and systemd (Linux). It also prompts the user to grant "Full Disk Access" to their terminal application to ensure functionality.- [COMMAND_EXECUTION]: Python helper scripts included in the skill documentation use subprocess.run to call system utilities such as osascript for generating desktop notifications.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted data (artwork titles, author names, and metadata) from the DeviantArt API, which is then stored in a local SQLite database and displayed or exported by various scripts.
Ingestion points: DeviantArt API data fetched via da-cli commands (e.g., da sync, da search).
Boundary markers: None present; the instructions do not include delimiters or warnings to ignore instructions embedded in the external content.
Capability inventory: The skill has the capability to write files (export_index_to_csv), perform network operations (API synchronization), and execute system commands (send_notification).
Sanitization: No sanitization, escaping, or validation logic is defined for handling the external API data before it is processed by the scripts.

da-cli-deviantart-sync