The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and documentation specify the use of shell commands including jq for JSON schema validation, grep and find for searching file patterns, and chmod for correcting script permissions. These are standard utility calls for the tool's primary purpose of plugin validation.
[DYNAMIC_EXECUTION]: The script scripts/validate_plugin_marketplace.py dynamically locates and executes an authoritative validation script (validate-skills-schema.py) by walking up the directory tree from its current location. It uses subprocess.run with a list of arguments, which is a standard and safe method for delegating tasks to other local scripts within a repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted plugin data (such as plugin.json and README.md files) to generate validation reports and suggested "fix commands." While this represents a vulnerability surface common to validators, the functionality is restricted to local file analysis and is central to the skill's purpose.
Ingestion points: Plugin configuration files (plugin.json), documentation (README.md), and component source files (commands, agents, skills, etc.) read from the target directory.
Boundary markers: None explicitly specified in the instructions for separating file content from agent instructions during processing.
Capability inventory: Access to Read, Grep, and Bash(cmd:*) for file system operations and script execution.
Sanitization: No specific content sanitization or escaping mechanisms are described before processing metadata for report generation.

plugin-validator