The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a custom Node.js script (scripts/xget.mjs) to perform various operations including URL conversion and metadata retrieval. The instructions explicitly direct the agent to execute shell commands directly for configuration tasks.
[EXTERNAL_DOWNLOADS]: The script scripts/xget.mjs fetches live configuration and documentation from raw.gitcode.com/xixu-me/xget/. These resources originate from the vendor's repository and are used to update the skill's behavior at runtime.
[PERSISTENCE]: The references/REFERENCE.md file contains instructions and commands for modifying shell profiles such as ~/.bashrc, ~/.zshrc, and PowerShell $PROFILE to persistently set the XGET_BASE_URL environment variable. While intended for legitimate configuration, modifying startup scripts is a standard persistence mechanism.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (README snippets and platform catalogs) from a remote repository and interpolates this content into its operational flow. There is a risk that maliciously crafted content in the remote source could influence agent behavior, although the data is sourced from a vendor-controlled environment. Mandatory Evidence Chain: 1. Ingestion points: scripts/xget.mjs (httpGet). 2. Boundary markers: None. 3. Capability inventory: Shell command execution, file modification (SKILL.md instructions). 4. Sanitization: Minimal (regex-based parsing of remote JS objects).

xget