The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary function is to find and install executable plugins using commands like claude plugin install and npm install. It specifically guides the agent to download and run code from the 'External Open-Source Ecosystem' (Priority 3) and various marketplaces. The use of npx --yes to execute packages directly from the npm registry is a high-risk pattern for dynamic code execution.
[EXTERNAL_DOWNLOADS]: The skill leverages WebSearch and WebFetch to ingest content from arbitrary GitHub repositories and external marketplaces. It processes README.md and plugin.json files from these untrusted sources to rank and recommend them for installation.
[CREDENTIALS_UNSAFE]: The skill provides explicit instructions and Bash commands to guide users through generating and entering GitHub Personal Access Tokens (PATs) with repo and read:org scopes. It uses gh auth login to store these credentials, which are then used by the agent to access internal and external repositories.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: Reads README.md and plugin.json from untrusted external GitHub repositories and marketplaces during the 'Candidate Plugin Analysis' (Step 3).
Boundary markers: None identified; the agent is instructed to analyze the external text directly to score and rank plugins.
Capability inventory: The agent has Bash, WebFetch, and Read capabilities, allowing it to perform network operations and file system modifications based on the analysis of external data.
Sanitization: No evidence of sanitization or filtering of the ingested README content before processing.
[DYNAMIC_EXECUTION]: The skill includes a 'SKILL.md Conversion Template' (Step 5-B-2) that dynamically generates new executable instruction files from external assets. It also executes Bash commands constructed from search results, such as claude plugin marketplace add "$SOURCE" and claude plugin install "$PLUGIN", where variables are derived from untrusted external metadata.

plugin-recommender