The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (create_plugin.py, bump_version.py) designed to be run locally to automate the creation of plugin directories and the updating of manifest files. These scripts perform read and write operations on local JSON configuration files (plugin.json, marketplace.json) to maintain plugin metadata.
[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection as it takes untrusted user input to generate file contents. (1) Ingestion points: CLI arguments in scripts/create_plugin.py and scripts/bump_version.py (such as plugin_name and description). (2) Boundary markers: None present. (3) Capability inventory: File system write access (open, mkdir) and JSON manifest modification. (4) Sanitization: The scripts do not perform explicit validation or sanitization of input strings against path traversal or command injection patterns.
[SAFE]: All operations are confined to the local file system and standard developer workflows. No external network connections, credential harvesting, or obfuscated payloads were identified.

plugin-forge