The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx github:timschoch/skilly to download and execute setup modules directly from the author's GitHub repository. This is a vendor-owned resource used for just-in-time tool installation.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands such as npx for package management and gh for triggering and monitoring GitHub Actions workflows.
[INDIRECT_PROMPT_INJECTION]: The workflow involves reading and following instructions from sub-skills installed at runtime, which creates a surface where instructions from those files influence the agent's actions.
Ingestion points: Dynamically installed SKILL.md files from modules like setup-pre-commit or setup-repo.
Boundary markers: The agent is explicitly told to "READ the installed SKILL.md and follow it directly."
Capability inventory: The skill environment has permissions for command execution and repository modification.
Sanitization: Content from the dynamically loaded skills is processed as instructional markdown without specialized validation.

setup-project