The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input—such as plugin names, descriptions, and keywords—to generate various files including plugin.json, README.md, and executable script components.
Ingestion points: User requests containing plugin metadata are interpolated into file templates.
Boundary markers: The skill relies on natural language boundaries but lacks specific escaping mechanisms for user-provided strings in generated markdown content.
Capability inventory: The skill possesses Write and Bash(cmd:*) permissions, allowing it to modify the filesystem and execute shell commands.
Sanitization: Employs jq for JSON syntax validation and executes a local validation script ./scripts/validate-all-plugins.sh to verify the integrity of the generated plugin structure.
[COMMAND_EXECUTION]: The skill executes local repository commands such as pnpm run sync-marketplace and ./scripts/validate-all-plugins.sh to integrate new plugins into the marketplace catalog. It also uses chmod +x to set executable permissions on generated script files, which is a standard procedure for this developer-oriented workflow.
[DYNAMIC_EXECUTION]: The skill dynamically generates functional plugin components (including commands, agents, and skills with YAML frontmatter) and then triggers validation processes on these newly created files.

plugin-creator