The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves skill definitions and metadata from the vendor's server to populate a catalog.
Evidence: Requests are made to https://app.mindos.com/gate/in/rest/third-party-agent/v1/skills/available and https://app.mindos.com/gate/in/rest/third-party-agent/v1/skills/{skillKey}.
[COMMAND_EXECUTION]: The skill performs local file system operations to install the downloaded bundles into the agent's environment.
Evidence: The skill creates directories and writes files (such as SKILL.md, prompt.md, and prompt_short.md) based on the content received from the generatedSkillFiles field in the API response.
[DATA_EXPOSURE]: The skill accesses a local file to retrieve authentication credentials necessary for communicating with the vendor's API.
Evidence: It reads {baseDir}/.credentials to obtain an accessToken. This is a sensitive file path, but the access is consistent with the skill's primary function and targets the vendor's own infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill installs external prompts and metadata which could potentially contain instructions that influence agent behavior.
Ingestion points: generatedSkillFiles from the app.mindos.com API.
Boundary markers: None present; the skill preserves server-provided file contents exactly.
Capability inventory: File-write operations to the local skill root.
Sanitization: No sanitization is performed as the skill is designed to mirror the server's content exactly.

secondme-external-skill-catalog