The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/install.sh script downloads and executes a remote shell script using the pattern curl -fsSL https://plannotator.ai/install.sh | bash. This allows for arbitrary code execution from an external, non-whitelisted domain during the installation process.
[COMMAND_EXECUTION]: Multiple setup scripts (setup-hook.sh, setup-gemini-hook.sh, setup-codex-hook.sh) modify application settings in the user's home directory to register hooks that trigger the plannotator command. The scripts/configure-remote.sh script modifies shell profiles such as .zshrc and .bashrc to inject persistent environment variables.
[COMMAND_EXECUTION]: The scripts/setup-opencode-plugin.sh script creates slash command definitions for OpenCode using dynamic context injection. The command !plannotator annotate "$ARGUMENTS"`` incorporates unvalidated user input directly into a shell command, facilitating command injection.
[DATA_EXFILTRATION]: The skill captures agent plans and git diffs, which can contain sensitive source code or project details. It provides features to export this data to external note-taking apps like Obsidian and Bear, or share them via a third-party portal at share.plannotator.ai.
[PROMPT_INJECTION]: Instructions appended to agent configuration files (e.g., ~/.codex/config.toml and ~/.gemini/GEMINI.md) override default agent behavior by mandating the use of the plannotator review workflow and directing the agent to execute specific shell commands to handle plan submissions.

plannotator