The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads extension scripts and application installers (.dmg) from the official 'MarkEdit-app' GitHub organization. It also allows users to specify custom URLs for JavaScript extensions, which is a standard feature for an extension manager.
[COMMAND_EXECUTION]: Uses system commands to manage the application lifecycle via osascript (quit and launch) and integrates with chezmoi for configuration file management. It also performs standard application installation steps such as extracting and moving .app bundles to the /Applications directory.
[DATA_EXFILTRATION]: Accesses application-specific configuration files (settings.json, editor.css, editor.js) and the scripts directory within the MarkEdit container (~/Library/Containers/app.cyan.markedit/). This access is necessary for the skill's primary purpose of managing the editor's settings and extensions.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is instructed to ingest data from external sources like the MarkEdit Wiki and GitHub Issues to answer user questions.
Ingestion points: GitHub Wiki pages and closed GitHub Issues (SKILL.md).
Boundary markers: None specified in the instructions.
Capability inventory: File system write access (settings and scripts), shell command execution (osascript), and configuration management (chezmoi).
Sanitization: No explicit sanitization or validation of the content retrieved from GitHub is described.

markedit-tools