The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and scripts recommend using npx -y skills@latest to fetch the package manager and additional skills from remote repositories such as GitHub and GitLab.
[REMOTE_CODE_EXECUTION]: The refresh_skills.py script automatically downloads and installs code from external sources defined in lockfiles or command-line arguments. The skill documentation explicitly acknowledges that this allows third-party code to execute unattended.
[PERSISTENCE]: The skill provides detailed instructions to add SessionStart hooks to agent configuration files, specifically ~/.claude/settings.json and ~/.codex/hooks.json. This causes the update script to execute every time an agent session begins.
[COMMAND_EXECUTION]: The provided Python scripts (refresh_skills.py) use subprocess.Popen to execute shell commands for interacting with the npx CLI and managing git repositories.
[PRIVILEGE_ESCALATION]: The skill instructions guide the agent to modify its own configuration files and create directory symlinks in system and project-level directories, such as ~/.claude/skills and ~/.agents/skills, to ensure skill discovery across different agent platforms.

skill-maker