The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents the xmake addon --install command, which allows for the installation and subsequent execution of code from remote repositories.
Evidence includes instructions for installing from GitHub (github:user/repo) and arbitrary Git URLs (https://github.com/u/r.git).
[EXTERNAL_DOWNLOADS]: The documentation encourages downloading external addons which are stored in the user's home directory (~/.xmake/addons/).
[COMMAND_EXECUTION]: The skill instructs the agent on how to use CLI commands that modify the system state, specifically the Xmake addon registry (addons.conf).
[INDIRECT_PROMPT_INJECTION]: The skill involves the agent reading and interpreting xmake.lua files and xmake-addons.lock files, which are ingestion points for untrusted data from external projects.
Ingestion points: xmake.lua, xmake-addons.lock, and addon payloads referenced via @addon or @self namespaces (SKILL.md).
Boundary markers: None identified; the agent is expected to process these files as authoritative project configurations.
Capability inventory: The skill uses xmake CLI commands and Lua import()/includes() calls to load and execute external logic.
Sanitization: None identified; the tool resolves and installs addons based on the string contents of the project files.

xmake-addons