The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of plugins that ingest untrusted thread data (such as thread titles and project names) and pass it to the amp.jev API for processing. This creates a surface where malicious content in thread data could influence the behavior of the plugin or the LLM output.
Ingestion points: The thread object passed to the plugin's entrypoint in client/index.mjs contains fields like title and project derived from the user environment.
Boundary markers: The instructions do not specify the use of delimiters or instructions to ignore embedded commands within the state or questions sent to amp.jev.
Capability inventory: Plugins have DOM access, authenticated network access, and the ability to modify the client UI (e.g., amp.sidebar.setOrbColorRule).
Sanitization: No explicit sanitization or validation of the ingested thread data is mentioned before it is processed by the logic or sent to the jev service.
[COMMAND_EXECUTION]: The documentation instructs the agent to use the amp CLI for repository management and to configure Git with a shell-executing credential helper (!amp git-credential-helper). These are platform-specific tools provided by the vendor for authenticated workflows.

building-client-plugins