The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides documentation and templates for the experimental.chat.system.transform hook, which allows created plugins to programmatically modify the agent's system prompt.
Ingestion points: Data from the chat environment (untrusted input) enters the plugin context via the hook's input parameters in SKILL.md.
Boundary markers: The provided documentation and code examples do not specify or encourage the use of boundary markers or delimiters to isolate injected content from instructions.
Capability inventory: The skill notes that plugins have access to high-privilege APIs including child_process, node:fs/promises, and fetch(), which amplifies the risk if the system prompt is manipulated.
Sanitization: There is no mention or implementation of sanitization, escaping, or validation for the content being pushed into the system prompt array.
[DYNAMIC_EXECUTION]: The skill instructs the agent to scaffold and write executable TypeScript code to the local filesystem (.opencode/plugins/) which is then dynamically loaded and executed by the OpenCode runtime.
The documentation explicitly mentions that these generated plugins can utilize child_process and fs, creating a significant surface for command execution and file system interaction.

create-plugin