The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically loads and executes Node.js modules from paths constructed using environment variables. Specifically, it uses require(process.env.CLAUDE_PLUGIN_ROOT + "/scripts/lib/terminal-welcome") within a node -e command string, and executes scripts via node "$CLAUDE_PLUGIN_ROOT/scripts/setup.js".
[COMMAND_EXECUTION]: The skill executes multiple shell commands to inventory the system, run setup scripts, and verify the installation using tools such as node, npx, claude, and codex.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes code from external sources using npx --yes --package ecc-universal and adds a remote repository via codex plugin marketplace add affaan-m/ECC. These represent vendor-owned resources.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external command outputs, such as claude plugin list --json. Although it includes validation steps like checking against ECC_VERSION_PATTERN, the pattern of reading untrusted output and using it to influence subsequent tool execution presents a potential attack surface.

configure-ecc