The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources including user-provided arguments, local skill directories, and external documentation URLs. This creates a surface for indirect prompt injection where malicious instructions in these sources could potentially influence the agent's behavior.
Ingestion points: User-supplied $ARGUMENTS in SKILL.md; local skill files read from ~/.claude/skills/ during Phase 1 research; documentation fetched from code.claude.com during Phase 1 and Phase 4.
Boundary markers: The skill uses XML-style tags (e.g., <plugin_concept>, <task>) to structure its internal rules and generated tasks, providing some structural separation, but it lacks explicit instructions to sanitize or ignore instructions embedded in ingested content.
Capability inventory: The skill can execute shell commands via uv run, uvx, and git, and it can spawn sub-agents with various tool capabilities.
Sanitization: No specific sanitization or filtering of external content is described before interpolation or processing.
[COMMAND_EXECUTION]: The workflow performs shell operations, including executing a local Python script (scripts/create_plugin.py) for scaffolding, running git commands for atomic commits, and using uvx for validation. These commands are executed as part of the plugin creation lifecycle.
[EXTERNAL_DOWNLOADS]: The skill uses uvx skilllint@latest to fetch and execute a remote validation tool. It also instructs sub-agents to fetch official documentation from code.claude.com for research and compliance checking. These resources are part of the platform's official documentation and tooling ecosystem.
[DYNAMIC_EXECUTION]: The skill generates and writes new code files (scripts, agents, and skills) based on a design plan. While this is the primary purpose of the skill, the generation of executable content from model-generated plans involves dynamic content creation.

plugin-creator