The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include installing the clawhub CLI globally via npm and fetching skills/data from the remote registry at https://clawhub.com. These operations are central to the skill's primary function as a package manager.
[COMMAND_EXECUTION]: The skill provides numerous CLI command examples for authenticating, searching, installing, and updating skills on the local system.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the download and installation of external agent skills, which represents a potential attack surface if remote content is malicious.
Ingestion points: Remote skills downloaded via clawhub install and clawhub update from https://clawhub.com (documented in SKILL.md).
Boundary markers: None specified; instructions do not include delimiters or warnings to ignore instructions embedded in downloaded content.
Capability inventory: The skill utilizes npm for installation and the clawhub CLI for file management and network communication.
Sanitization: No evidence of automated sanitization, signature verification, or integrity checking of the downloaded skill content is present in the provided instructions.

clawhub