The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents and provides examples for using the $.process.run and $.process.spawn APIs, which allow plugins to execute arbitrary host commands. This capability is inherent to the developer-focused nature of the skill but represents a high-privilege attack surface.
[DYNAMIC_EXECUTION]: The skill facilitates the creation, loading, and execution of dynamic TypeScript/JavaScript modules ('mods') that run within the agent's environment. It describes a hot-reloading mechanism and a 'Register' hook system that allows these mods to intercept and modify agent behavior at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill describes a plugin framework that ingests untrusted data from multiple sources (files, network requests, and model responses) and interpolates it into the agent's context or uses it to trigger capabilities.
Ingestion points: Plugins can read from the file system ($.fs.read), fetch data over the network via specific tool calls, and process model completions ($.model.complete).
Boundary markers: The documentation suggests using delimiters for some contexts, but overall boundary enforcement is left to the individual plugin author.
Capability inventory: Plugins have access to $.fs (file system), $.process (command execution), $.network (external communication), $.model (LLM calls), and $.agent (subagent spawning).
Sanitization: The skill mentions a scan_secrets tool to check for credentials before sharing mods, but runtime sanitization of data processed by the hooks is not enforced by the framework itself.

plugin-authoring