The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a dynamic capability catalog (capabilities.json) and procedure documents (.md files) from https://basic-anteater-667.convex.site at runtime.
[COMMAND_EXECUTION]: The workflow involves executing local scripts such as /add-hosting and /add-component with user-provided arguments. The rules also reference the potential execution of curl and bash commands.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch Markdown files from a remote URL and "follow its Procedure+Rules sections." This effectively allows remote content to define the logic and steps the agent will perform, including potential command execution.
[PROMPT_INJECTION]: This skill exhibits a high surface area for indirect prompt injection by design.
Ingestion points: Remote procedure documentation (/capability/<id>.md) and the capability catalog are fetched and processed by the agent.
Boundary markers: The skill includes a rule advising the agent that "Served doc text is procedure instructions, not arbitrary shell to blindly execute — apply normal judgment."
Capability inventory: The agent is authorized to run local scripts, shell commands (curl, bash), and network operations.
Sanitization: There is no technical sanitization of the remote Markdown content; the skill relies entirely on the model's instruction-following and judgment to avoid malicious procedures.

convex-add