The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download installation scripts (install.sh and install.ps1) and an ONNX embedding model (all-MiniLM-L6-v2) from external sources.
Evidence: curl -fsSL https://cli.truto.one/install.sh | bash and irm https://cli.truto.one/install.ps1 | iex in SKILL.md.
Evidence: Mentions automatic download of all-MiniLM-L6-v2 (~35 MB) for local embeddings in SKILL.md.
[REMOTE_CODE_EXECUTION]: The installation instructions utilize high-privilege execution patterns (piping remote scripts directly to shell interpreters).
Evidence: curl ... | bash (Linux/macOS) and irm ... | iex (Windows/PowerShell) targeting https://cli.truto.one/.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior during the integration build process.
Ingestion points: External API documentation URLs, OpenAPI specs, Postman collections, and generic web pages accessed via web_search, web_fetch, read_source_method, and search_source (referenced in references/orchestrator-phases.md).
Boundary markers: Not explicitly defined in the provided text, but the agent operates within a structured build loop.
Capability inventory: The agent can generate and write local JSON configuration files (--out) and push these configurations to the Truto platform via truto integrations apply.
Sanitization: The workflow includes a mandatory human-in-the-loop "Phase B" for interactive refinement where the user reviews all proposed patches before they are finalized. It also incorporates a static auditor (truto integrations lint) to validate the generated configuration against known patterns and schemas.
[COMMAND_EXECUTION]: The skill provides numerous examples of shell commands for CLI interaction, authentication, and integration management.
Evidence: truto login, truto profiles set-key, truto integrations build, truto integrations lint, and truto integrations apply in SKILL.md.

truto-integrations-build