The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes instructions to download installation scripts from the vendor's domain at https://cli.truto.one/install.sh for Linux/macOS and https://cli.truto.one/install.ps1 for Windows. These are standard resources for the initial setup of the Truto CLI.
[REMOTE_CODE_EXECUTION]: The provided installation commands pipe remote scripts directly into shell environments (bash and PowerShell's Invoke-Expression). This is a documented and intended mechanism for deploying the CLI tool as provided by the vendor.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the retrieval of data from external accounts via the unified and proxy commands. This data is ingested into the agent's context. The skill advises using structured formats like JSON and NDJSON for output, which can mitigate accidental interpretation of data as instructions. While the skill has capabilities to modify platform resources and upload files, these functions are consistent with its purpose as an administrative tool.
[CREDENTIALS_UNSAFE]: The documentation describes how to authenticate the CLI using API tokens and notes that credentials are saved to a configuration file at ~/.truto/config.json. No hardcoded secrets or sensitive credentials were found within the skill files.
[DYNAMIC_EXECUTION]: The skill features a jsonata eval command for local evaluation of JSONata expressions against JSON data. This functionality is provided by the @truto/truto-jsonata library and is a core feature for data transformation within the platform.

Truto CLI