The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/fetch_skill.py utility downloads skill source code from GitHub repositories using git clone and the GitHub CLI (gh). These operations target well-known services and are essential for the skill's stated purpose of auditing third-party code.
[COMMAND_EXECUTION]: The skill utilizes subprocess calls to execute system tools like git and gh (GitHub CLI) for repository management and metadata retrieval, which is appropriate for a developer utility.
[COMMAND_EXECUTION]: File system operations, including directory creation (mkdir) and file permission modifications (chmod), are performed by scripts to scaffold and package skill projects.
[PROMPT_INJECTION]: The skill processes untrusted third-party code from external repositories, which constitutes an indirect prompt injection surface.
Ingestion point: scripts/fetch_skill.py clones external repositories into local temporary directories for inspection.
Boundary markers: Absent; no specific delimiters or ignore instructions are provided to isolate the agent from instructions embedded in the analyzed skills.
Capability inventory: Includes subprocess execution of git and gh in fetch_skill.py and local file system writes in init_skill.py.
Sanitization: Absent; external file contents are read directly for static analysis without filtering.

skill-building