The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/atoms-search.py script performs network requests to https://api.xyskill.xyz using the urllib.request library. This domain is owned by the skill vendor (xyaz1313) and is used to retrieve business knowledge 'atoms' as part of the skill's core functionality.
[COMMAND_EXECUTION]: The skill invokes a local Python script scripts/atoms-search.py via shell command to process user queries. This script handles local file lookups for atoms.jsonl and remote API calls.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by passing it as a search query to an external script and API. Ingestion points: User input in SKILL.md and atoms-search.py. Boundary markers: Absent. Capability inventory: File system access (open) and network operations (urllib.request.urlopen) within atoms-search.py. Sanitization: The script correctly uses json.dumps to sanitize the payload for the remote API.

xy-ops