The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches update assets by cloning a remote repository from GitHub. It specifically uses a pinned commit hash to ensure the integrity of the downloaded content and mandates user authorization before performing the clone operation.
[COMMAND_EXECUTION]: Uses standard shell commands for project discovery and repository management, such as find, cat, and git. The execution is transparently described and limited to the stated purpose of updating project files.
[DATA_EXFILTRATION]: No unauthorized data transmission was detected. Network activity is limited to downloading updates from a vendor-associated repository, and no sensitive local information is included in these requests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files during the update process. It mitigates potential risks by instructing the agent to perform a manual inspection of the candidate files and to explicitly reject executable scripts or unexpected binaries before they are applied to the project.

ui-update