The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides installation instructions from official and well-known sources, including Homebrew (block/tap/goose), PyPI (pipx install goose-ai), and the official Block GitHub repository (github.com/block/goose.git). These are standard procedures for developer tooling.
[COMMAND_EXECUTION]: The documentation describes Goose's capability for shell command execution and package installation, which is the primary and intended purpose of the agent. The examples provided are instructional (e.g., unit tests, status checks) and do not contain malicious payloads.
[CREDENTIALS_UNSAFE]: The documentation uses standard placeholders for environment variables (sk-..., ${JIRA_TOKEN}, ${DATABASE_URL}) and correctly identifies ~/.config/goose/profiles.yaml as the location for configuration, which is consistent with secure credential management practices.
[REMOTE_CODE_EXECUTION]: Examples show the use of npx to run MCP servers (e.g., @modelcontextprotocol/server-jira). This is a legitimate and documented feature of the Model Context Protocol for dynamically loading agent capabilities from official package registries.

goose