The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill utilizes npx --yes skills find <domain-keyword>, which downloads and executes the skills package from the NPM registry. The use of the --yes flag allows for the silent execution of remote code without requiring user confirmation.
[COMMAND_EXECUTION]: The workflow encourages the use of /skills-install <owner/repo> to download and install content from external GitHub repositories. This provides a mechanism for the agent to integrate unvetted third-party instructions or scripts into its operating environment.
[EXTERNAL_DOWNLOADS]: The skill performs network operations using curl to fetch data from api.skyll.app. This is a non-standard external service used for searching a skill marketplace.
[EXTERNAL_DOWNLOADS]: The skill references repositories from several organizations including anthropics/skills and vercel-labs/agent-skills for auto-installation of validated skills.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for searching and downloading content from community repositories on GitHub via the gh CLI tool. While it suggests manual review steps (license checks, quality checks), it ultimately relies on the agent to evaluate the safety of the downloaded content.
[REMOTE_CODE_EXECUTION]: In 'Tier 3: Synthesize from Documentation', the skill describes extracting procedures from external documentation and injecting them into the agent's context via /skills-create. This process of dynamic instruction generation from untrusted external sources creates a surface for indirect prompt injection.

external-skill-acquisition