The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx to run the @xgent/release-cli tool for publishing activities. It also utilizes spawnSync in scripts/preflight.mjs to execute tar for verifying that distribution packages can be correctly archived. These are standard operations for building and deploying software.
[EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's private NPM registry to download necessary packages such as @xgent/shared and @xgent/portal-sdk. It also downloads the release CLI tool via npx. These resources are owned by the skill's vendor and are required for its primary function.
[INDIRECT_PROMPT_INJECTION]: The scripts/preflight.mjs script performs static analysis on files within the project's distribution directory to detect and warn about potential issues like hardcoded localhost references.
Ingestion points: The script reads the content of .js, .mjs, .css, .html, and .json files within the user-specified distribution folder.
Boundary markers: None are present for the content being scanned.
Capability inventory: The script has capabilities to execute shell commands (spawnSync) and make network requests (fetch).
Sanitization: The script performs read-only regex scanning to identify specific patterns and does not execute the ingested content as instructions. The risk is minimized by the skill's focus on release-time validation.

xgent-app-release