The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/install.sh and SETUP.md files instruct the agent to execute curl -sSfL https://plannotator.ai/install.sh | sh. This pattern is high-risk as it allows an external server to execute arbitrary code on the host machine without verification.
[EXTERNAL_DOWNLOADS]: The skill downloads tools from https://plannotator.ai, which is an unverified external source not associated with trusted vendors.
[DATA_EXFILTRATION]: The scripts/phase-gate-review.sh utility reads project documentation and transmits the full content to an external service at plannotator.ai.
[COMMAND_EXECUTION]: The skill uses python3 -c to execute dynamic code blocks within its management scripts, creating potential risks if document structures are manipulated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by processing project files from the docs/ directory without sanitization or boundary markers, which could allow malicious instructions in those files to redirect the agent's behavior. Evidence chain: 1. Ingestion: docs/*.md; 2. Boundaries: Absent; 3. Capabilities: Bash tool and network submission; 4. Sanitization: Absent.

bmad