The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user or agent to run shell commands including xmake package, xrepo add-repo, xrepo update-repo, and xmake l scripts/test.lua for building projects and managing package repositories.
[EXTERNAL_DOWNLOADS]: The documentation demonstrates how to configure the agent to fetch content from remote sources, specifically Git repositories (git@github.com:mycompany/my-repo.git) and HTTPS servers (https://dist.example.com/foo/foo-$(version).tar.gz). These are presented as placeholders for private infrastructure.
[REMOTE_CODE_EXECUTION]: The skill utilizes xmake package recipes which contain on_install and on_test hooks. These hooks allow the execution of Lua scripts to manage the build and installation process of downloaded packages, which can involve network and file system operations at install-time.
[DYNAMIC_EXECUTION]: Package configuration files (xmake.lua) use a Lua-based Domain Specific Language (DSL). The provided examples include the use of import to load modules (package.tools.xmake) and os functions (os.cp) to perform file system operations at runtime during the package installation phase.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill defines the structure for xmake.lua recipes in SKILL.md which might be generated or modified by an agent based on external project descriptions or untrusted source data.
Boundary markers: The templates do not include specific delimiters or instructions to ignore malicious content within the interpolated fields (such as add_urls).
Capability inventory: The xmake execution environment has capabilities for file system access, network operations, and running shell commands via its Lua engine.
Sanitization: There is no evidence of input validation or sanitization for the URLs, version strings, or commit hashes used within the generated recipes.

xmake-private-packages