The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates downloading content from external Git repositories and specific marketplaces (e.g., skills.sh). It includes examples pointing to trusted organizations such as Anthropics and Vercel, while also supporting arbitrary user-defined URLs.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using a specialized CLI tool. These commands perform file system operations, such as deploying, updating, and removing skill files within the user's agent directories (e.g., ~/.claude/skills).
[INDIRECT_PROMPT_INJECTION]: As a manager for other agent instructions (skills), this tool creates an attack surface where malicious prompts could be embedded in the SKILL.md files of third-party repositories. The skill attempts to mitigate this by instructing the agent to evaluate the popularity and source of skills before installation. \n
Ingestion points: Remote Git repositories and local agent directories scanned during the adopt or install processes. \n
Boundary markers: The skill relies on agent-led verification of source reputation and dry-runs but does not implement programmatic boundary enforcement on skill content. \n
Capability inventory: The associated CLI tool has capabilities for network downloads and extensive local file system modifications. \n
Sanitization: No explicit sanitization or filtering of the instructions contained within the managed skills is documented.
[DYNAMIC_EXECUTION]: The skill manages the lifecycle of instructions that are dynamically added to the agent's operating environment. This involves pulling external content into the agent's path for subsequent execution as active skills.

manage-skills