The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install.sh executes remote code from https://plannotator.ai/install.sh by piping the output of curl directly into bash. This pattern allows the execution of unverified scripts with the user's privileges.
[DYNAMIC_CONTEXT_INJECTION]: The OpenCode plugin registration (scripts/setup-opencode-plugin.sh) creates command files that utilize the !command syntax. This syntax is used to execute shell commands at the time the skill is loaded by the agent, creating a dynamic execution surface.
[COMMAND_EXECUTION]: In the generated plannotator-annotate.md file, the skill passes user-provided arguments directly into a shell execution context: !"plannotator annotate "$ARGUMENTS"". Because the input is not sanitized or escaped, it allows an attacker or malicious user input to execute arbitrary shell commands via injection.
[PERSISTENCE]: Multiple scripts (setup-hook.sh, setup-gemini-hook.sh, setup-codex-hook.sh, configure-remote.sh) modify configuration files in the user's home directory (e.g., ~/.claude/settings.json, ~/.gemini/settings.json, ~/.codex/config.toml) and shell profiles (e.g., .bashrc, .zshrc). These modifications install execution hooks and set environment variables that persist across different agent sessions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data such as git diffs and markdown files, which can contain hidden instructions targeting the AI agent.
Ingestion points: Files read by plannotator review and plannotator annotate.
Boundary markers: None identified; the instructions are not delimited or protected by warnings against embedded instructions.
Capability inventory: The skill has access to Bash and Write tools, providing a high-privilege path for any successful prompt injection.
Sanitization: No validation is performed on external data before it is rendered or used in shell commands.

plannotator