The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves package metadata and export declarations from public registries, specifically registry.npmjs.org and unpkg.com. These are well-known services used for package management and content delivery.
[EXTERNAL_DOWNLOADS]: The skill fetches source and type definition files from the XYOracleNetwork GitHub organization via raw.githubusercontent.com. This organization matches the skill's author context and represents a legitimate vendor resource.
[COMMAND_EXECUTION]: The skill utilizes the Grep tool to scan for import statements within specified directories (plugins/xl1-skills/skills/) and uses the Edit tool to apply mechanical fixes to those imports when the --fix flag is provided.
[DATA_EXPOSURE_AND_EXFILTRATION]: Package metadata is cached locally in /tmp/xyo-barrel-exports.*.json for performance. No sensitive local files or environment variables are accessed or transmitted.
[SAFE]: The execution plan is transparently documented, including the scope of operations and the use of parallel agents for network fetching and analysis. The behavior is consistent with its stated purpose of auditing import hygiene.

audit-imports