The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes an agentic tool that processes untrusted data from local repositories, PR diffs, and stdin streams, which presents a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through the filesystem (repo code), standard input (via --input-format stream-json), and external CLI tool outputs like gh pr diff (referenced in SKILL.md and references/patterns.md).
Boundary markers: The documentation recommends using --permission-mode dontAsk and --allowedTools to limit the agent's autonomy when processing potentially malicious data (detailed in references/permissions.md).
Capability inventory: The tool has access to high-privilege capabilities including Bash for command execution, Edit for modifying files, and Read for accessing sensitive local data (catalogued in references/cli-flags.md).
Sanitization: The skill does not describe specific input sanitization, relying on the platform's internal safety guardrails.
[EXTERNAL_DOWNLOADS]: The documentation describes features that enable the retrieval of remote resources at runtime.
The --plugin-url flag is documented as a way to fetch plugin zip archives from arbitrary URLs (references/cli-flags.md).
The --file flag allows for downloading specific file resources at startup.
[REMOTE_CODE_EXECUTION]: The skill documents the --plugin-url flag, which constitutes a remote code execution vector by allowing the tool to download and load executable plugins from external sources.
[COMMAND_EXECUTION]: The skill provides extensive documentation on executing shell commands, both through the primary Bash tool and through background session features like claude --bg --exec (found in references/agent-view.md).
[DYNAMIC_EXECUTION]: The skill details how to dynamically load and execute code at runtime using flags like --plugin-dir and --plugin-url (references/cli-flags.md).
[CREDENTIALS_UNSAFE]: The documentation provides guidance on handling sensitive authentication tokens and API keys, including examples for setting ANTHROPIC_API_KEY and using apiKeyHelper to automate credential retrieval (references/auth.md).

claude-headless