The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references downloads from the vendor's official domain (get.x-cmd.com), GitHub releases (github.com/x-cmd/release), and common package registries (conda.prefix.dev). These are documented as sources for the tool's core binaries and installation scripts.
[REMOTE_CODE_EXECUTION]: The documentation provides a method to install the framework by piping a remote script to a shell (curl | sh). This is explicitly presented with a 'High Risk' warning, advising users to avoid it in sensitive environments and suggesting manual script review or Homebrew as safer alternatives.
[COMMAND_EXECUTION]: The skill uses POSIX shell commands to verify the presence of the framework ([ -f "$HOME/.x-cmd.root/X" ]) and to query installation instructions for specific software packages (x install --cat <software>).
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Software names provided in user queries are interpolated into shell commands in SKILL.md.
Boundary markers: No explicit boundary markers or delimiters are used in the command interpolation.
Capability inventory: The skill can execute x-cmd subcommands and load shell configuration files.
Sanitization: No input sanitization or validation is applied to the software name parameter before it is passed to the shell.

x-install