The Agent Skills Directory

[OBFUSCATION]: The file scripts/vendor/js-yaml.min.cjs contains minified JavaScript code. Minified code obscures logic and complicates security auditing, making it difficult to verify the absence of malicious behavior in the vendored library.\n- [DYNAMIC_EXECUTION]: The validation script scripts/validate-plugin-layout.sh generates Node.js code snippets at runtime and executes them using the node CLI. This pattern of generating and executing code strings based on file paths and keys is a risk factor if the generation process can be influenced by malicious input.\n- [COMMAND_EXECUTION]: The skill's validation script executes shell commands such as node and grep to analyze the plugin project's configuration and source files locally.\n- [INDIRECT_PROMPT_INJECTION]: The validation tool processes external project descriptors and source code, creating a potential attack surface where malicious content in those files could attempt to influence the agent's interpretation of the validation results.\n
Ingestion points: The script reads content from plugin.yml, paper-plugin.yml, and various Java or Kotlin source files within the project directory.\n
Boundary markers: No specific delimiters or safety warnings are implemented to separate the untrusted file content from the script's logic.\n
Capability inventory: The script can execute local system commands and perform file existence and content checks.\n
Sanitization: The script relies on the js-yaml library for parsing without additional sanitization or filtering of the input content before processing.

minecraft-plugin-dev