The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a commit hash from the GitHub API and downloads a source archive from the renoise-ai GitHub organization (https://codeload.github.com/renoise-ai/renoise-skills/tar.gz/<commit>). These downloads are used to update and install the skill's components to a local cache directory.
[COMMAND_EXECUTION]: The skill uses shell commands to manage its environment, specifically using curl to download assets, mkdir for directory management, and tar to extract downloaded content. It also utilizes the Renoise sandbox tool for execution.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to read and execute instructions from a secondary SKILL.md file that is downloaded from a remote repository at runtime.
Boundary markers: No explicit in-prompt delimiters or boundary markers are defined in this bootstrap file for the content of the downloaded file.
Capability inventory: The skill environment permits shell command execution, file system access (within ~/.cache/), and network access via curl.
Sanitization: The skill relies on the vendor's CI process and the use of a stable branch for content verification, but it lacks runtime sanitization of the downloaded markdown instructions. It mitigates risk by requiring explicit user consent for cost-sensitive or task-creation operations.

digital-human-koubo