The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill guides the user to install official vendor packages from PyPI and NPM (e.g., maximem-synap, @maximem/synap-js-sdk). These resources originate from the vendor's documented infrastructure and are necessary for the skill's core functionality.- [DATA_EXFILTRATION]: The skill implements a 'PAUSE' procedure, instructing the agent to wait for the user to provide an API key rather than attempting to harvest it or access unauthorized files. It explicitly recommends against committing secrets to version control and suggests using environment variables or secret managers.- [COMMAND_EXECUTION]: The skill uses the Bash tool to run a local verification script (scripts/verify_synap.py) to confirm the connection to the service. This script is transparently provided in the skill files and performs a benign connectivity check.- [INDIRECT_PROMPT_INJECTION]: The skill serves as a memory layer, which inherently involves ingesting and retrieving untrusted conversation data. While this represents a theoretical attack surface, the skill provides structured formatting (e.g., '## Facts', '## Preferences') and explicit retrieval logic that aligns with standard industry practices for RAG (Retrieval-Augmented Generation) systems.- [DYNAMIC_EXECUTION]: The TypeScript SDK is documented to spawn a Python subprocess to bridge core SDK functionality. This is a functional requirement for the multi-language support described in the integration guides and does not involve the execution of obfuscated or remotely fetched code.

synap