The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions fetch a command-line interface (CLI) tool directly from a GitHub repository using npx github:tt-a1i/agents-market#preview-0.1.0. While this resource belongs to the skill's author, it involves downloading code from an external source at runtime.
[REMOTE_CODE_EXECUTION]: The skill is designed to download and install 'subagent packs' from remote registries into the local environment, which involves executing code or logic fetched from external sources.
[COMMAND_EXECUTION]: The skill uses the agents-market CLI to perform multiple operations including repository inspection, searching for agents, and applying installation changes to the filesystem.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it processes data from external agent registries.
Ingestion points: Untrusted data enters the context through agents-market registry info and agents-market apply commands which fetch remote registry content (SKILL.md).
Boundary markers: The skill mitigates risks by requiring an audit and preview step (agents-market apply --json) followed by explicit user confirmation before final installation.
Capability inventory: The skill possesses the capability to execute shell commands and modify local project files across all target platforms (Claude Code, Codex, OpenCode).
Sanitization: The workflow relies on the tool's internal policy check (agents-market apply with audit) to validate external content before installation.

agents-market-installer