The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from plugin directories, creating a surface for indirect prompt injection attacks where malicious code could influence the refactoring design.
Ingestion points: The skill reads files from the ./plugins/<plugin_name>/ directory during Phase 1 (Assessment) and Phase 4 (Context Gathering).
Boundary markers: The instructions do not define clear delimiters or provided specific 'ignore instructions' warnings when processing the plugin content.
Capability inventory: The skill has the capability to write design and task files to the local filesystem (.plugin-creator/plans/) and dispatch operations to other refactoring agents.
Sanitization: No sanitization or filtering logic is present to validate the content of the ingested plugin files before they are processed by the agent.
[PROMPT_INJECTION]: User-supplied input is interpolated directly into a tagged structure in the prompt, which could allow for instruction overrides.
Evidence: The $ARGUMENTS variable is placed directly inside <plugin_name> tags in the initial planning section. A malicious user could provide input designed to close the XML-style tag and append new, conflicting instructions to the agent's context.

assessor