The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run @spotify/portal-cli. This package is a Spotify-owned resource and the tool invocation is the primary functionality of the skill.- [COMMAND_EXECUTION]: The skill executes a shell command npx @spotify/portal-cli actions telemetry:submit-feedback --text "<feedback>". The <feedback> placeholder is populated with user-supplied text, which could lead to command injection if the input is not properly handled by the execution environment.- [INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill accepts arbitrary text from the user to be used as feedback (SKILL.md).
Boundary markers: Instructions require the agent to "Show the exact text that will be sent and ask before invoking the action."
Capability inventory: Subprocess execution via npx shell command (SKILL.md).
Sanitization: Instructions explicitly forbid including secrets, tokens, or personal data and require asking the user to rephrase if such data is detected.

feedback