The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external HuggingFace model cards to automatically populate documentation fields and prose. This represents a potential attack surface where a malicious model card could attempt to influence the agent's output.
Ingestion points: HuggingFace model card pages (SKILL.md Phase 1).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the fetched content as untrusted data.
Capability inventory: The agent has the capability to write files (MDX, JSX), execute shell commands (git, gh, mint, python), and create Pull Requests (SKILL.md Phase 6).
Sanitization: There is no mention of sanitizing or validating the text extracted from the external source before it is used to generate documentation.
[EXTERNAL_DOWNLOADS]: The skill's instructions involve downloading software and libraries from well-known repositories and registries.
Evidence: Installs the Pillow image processing library from PyPI (references/vendor-logo.md).
Evidence: Installs the uv and sglang packages via pip/uv (templates/page.mdx.tmpl).
Evidence: Downloads and installs the sgl-eval tool from the vendor's GitHub repository (templates/config.jsx.tmpl).
[COMMAND_EXECUTION]: The skill utilizes several standard command-line tools for development and documentation workflows.
Evidence: Uses git for branching and committing changes, and gh for managing Pull Requests and performing duplicate checks (SKILL.md).
Evidence: Uses mint (Mintlify CLI) for documentation validation and local development (SKILL.md Phase 3).
Evidence: Uses python3 for creating virtual environments, installing packages, and running image processing tasks (references/vendor-logo.md).

cookbook-add-model