The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's primary purpose is the generation and execution of dynamic JavaScript code. It uses the cordis_define tool to register plain JavaScript function bodies for both code.host and code.client environments, which are then executed at runtime via the cordis_run tool.
[COMMAND_EXECUTION]: Host-side plugins are granted access to highly sensitive system capabilities. The documentation explicitly lists bash, subprocess, and pty (pseudo-terminals) as available services that can be inspected and used, allowing the agent to execute arbitrary shell commands and manage system processes.
[DATA_EXFILTRATION]: The skill facilitates access to sensitive platform and session data, including conversation snapshots, session history, and workspace lists. Additionally, it references a web service for networking requirements on the host, which provides a pathway for external data transmission.
[INDIRECT_PROMPT_INJECTION]: The skill defines a framework that is vulnerable to indirect prompt injection through the following surface area:
Ingestion points: Untrusted data enters the plugin context through Event payloads, Slot props, and incoming User requests.
Boundary markers: The instructions lack definitions for delimiters or warnings to ignore instructions embedded within external data.
Capability inventory: The plugin environment allows for powerful side effects including fs (filesystem) access and shell command execution (bash).
Sanitization: There are no explicit requirements for sanitizing, escaping, or validating external content before it is utilized within the plugin's logic.

cordis-plugin-development