The Agent Skills Directory

[DYNAMIC_EXECUTION]: The core functionality in scripts/plugin_system.py uses the importlib.util library to dynamically load and execute Python modules from a file system path.
The _load_plugin_from_file method uses importlib.util.spec_from_file_location and spec.loader.exec_module(module) to load scripts discovered in the target directory.
The system instantiates classes that inherit from PluginBase at runtime and invokes their execute() method through the PluginManager.execute_plugin() interface.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a significant attack surface for indirect execution if the local environment is exposed to untrusted file writes.
Ingestion points: The plugins_dir parameter (defaulting to ./plugins) determines which scripts are automatically discovered and loaded into the agent's execution context.
Boundary markers: While the skill provides fault tolerance by wrapping execution in try/except blocks to prevent application crashes, it does not implement sandboxing or isolation for the code within the plugins.
Capability inventory: The system grants full access to the Python interpreter's capabilities to any script placed in the discovery directory, including file system access and system calls.
Sanitization: The implementation lacks integrity verification (such as digital signatures or hash checks) for discovered plugins before they are executed.
[DATA_EXFILTRATION]: The example tool examples/systeminfo.py demonstrates the capability to harvest system-level metadata, which could be misused if configured to send data externally.
The script accesses sensitive host information including platform.node() (hostname), os.getpid() (process ID), and os.getcwd() (current working directory) when the detailed argument is utilized.

plugin-system