The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install.sh downloads and executes a shell script directly from a remote server using the command curl -fsSL https://plannotator.ai/install.sh | bash. Similar patterns are implemented for PowerShell using iex and Windows CMD. This allows for arbitrary code execution from the remote source on the user's system.
[COMMAND_EXECUTION]: The script scripts/configure-remote.sh modifies the user's shell environment by appending export statements to profile files like ~/.bashrc, ~/.zshrc, and ~/.profile. This is a persistence technique used to store environment variables across different terminal sessions.
[COMMAND_EXECUTION]: The script scripts/setup-opencode-plugin.sh creates command definitions for the OpenCode platform that utilize the dynamic !command syntax. Specifically, it generates a command !plannotator annotate "$ARGUMENTS" which interpolates user-supplied arguments directly into a shell string, creating a command injection vulnerability if the arguments contain shell metacharacters.
[PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as its primary purpose is to process external artifacts like git diffs, implementation plans, and markdown specifications. Combined with its extensive capabilities (Bash and Write tools), malicious instructions embedded within a reviewed artifact could influence agent behavior.
Ingestion points: Git repository diffs via scripts/review.sh, markdown files via annotation commands, and implementation plans via tool-specific hooks.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are implemented when passing artifact content to the CLI or the agent context.
Capability inventory: Shell execution via the Bash tool and dynamic context injection (!); file system modification via the Write tool.
Sanitization: The scripts do not perform sanitization or validation of the content within processed artifacts before they are used in shell commands or displayed to the agent.

plannotator