The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the xtool binary from the vendor's repository (github.com/xtool-org/xtool) as an AppImage. This is a primary component of the skill's functionality.
[COMMAND_EXECUTION]: The scripts/check-environment.py script executes system commands such as swift --version and xtool --version using subprocess.run. The script uses secure, list-based argument passing to prevent shell injection, though it does execute local binaries found on the system PATH.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project configuration files including Package.swift, xtool.yml, and .sourcekit-lsp/config.json. This creates a potential surface for indirect prompt injection if the agent processes a malicious or untrusted repository.
Ingestion points: The agent is instructed to read Package.swift, xtool.yml, and .sourcekit-lsp/config.json from the target project directory (SKILL.md, references/project-config.md).
Boundary markers: No explicit delimiters or warnings to ignore instructions within these files are present in the skill.
Capability inventory: The skill can perform builds (xtool dev build), manage Apple authentication status, and deploy apps to connected iOS devices.
Sanitization: The skill relies on the standard CLI logic of the xtool binary and list-based subprocess calls in its verification scripts.

xtool