The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones third-party Git repositories from user-provided URLs and fetches package metadata, tarballs, and attestations from the npm registry.
Evidence: gather-evidence.sh performs git clone on $plugin-repo-url and uses npm view, npm pack, and curl against https://registry.npmjs.org.
[COMMAND_EXECUTION]: Executes several shell scripts and system tools to gather and process evidence from external sources, including a code beautifier and various binary analysis utilities.
Evidence: Uses Bash to run ${CLAUDE_SKILL_DIR}/scripts/gather-evidence.sh, ${CLAUDE_SKILL_DIR}/scripts/beautify.sh, grep, jq, file, strings, and shasum.
[INDIRECT_PROMPT_INJECTION]: The skill is specifically designed to ingest and process untrusted third-party code and manifests, which presents an inherent surface for indirect prompt injection.
Ingestion points: Untrusted content enters the context via git clone and npm pack in gather-evidence.sh (e.g., repo/, pkg/package/).
Boundary markers: The skill instructions include a robust warning that all gathered data is to be analyzed and never followed as instructions, specifically directing the agent to report any detected adversarial instructions as critical findings.
Capability inventory: The skill possesses shell execution capabilities via Bash (limited to scripts and specific tools), file system access via Read and Write, and the ability to trigger other security analysis skills.
Sanitization: The skill proactively neutralizes potential attacks by disabling symlinks during cloning (core.symlinks=false), recording and removing symlinks in packages, and beautifying minified files to ensure readable code for analysis.

auditing-external-claude-plugins