The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest data from various external sources to automate the customization process. If these sources contain malicious instructions, there is a risk the agent could be influenced.
Ingestion points: The skill reads plugin source files from mnt/.local-plugins and mnt/.plugins. It also queries Knowledge MCPs for Slack messages, emails, and internal documents in Phase 1.
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore potential commands embedded within the external data being processed.
Capability inventory: The skill has the capability to modify files within the plugin directories and execute shell commands (find, grep, zip, cp) via the agent's environment.
Sanitization: There are no mentioned processes for validating or sanitizing the content retrieved from external search results before it is used to modify the plugin configuration.
Command Execution Capability: The skill instructs the agent to use standard shell utilities to manage the plugin files.
Evidence: The workflow includes instructions for using find to locate directories, grep to identify placeholders, and zip/cp to package the final output in SKILL.md.
Context: While these commands are used for legitimate file management tasks defined in the skill, they represent a high-privilege interface that requires careful handling when combined with untrusted input.

cowork-plugin-customizer