The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/publish_plugin.py dynamically modifies the Python module search path (sys.path.insert(0, str(root))) based on paths resolved at runtime via environment variables like MOVIEPILOT_ROOT or directory traversal. It then performs imports from these computed paths (e.g., from app.runtime.config import settings). This pattern allows for the loading and execution of code from arbitrary filesystem locations if the environment variables or directory structure are manipulated.
[DATA_EXFILTRATION]: The skill's primary function is to upload local plugin files to remote GitHub repositories. While the script implements a comprehensive DEFAULT_EXCLUDES list for sensitive data (such as .env, .secret, .key, and .pem files), the --include parameter and the instructions in SKILL.md ("Never upload these files unless explicitly included") provide a mechanism to bypass these protections. This creates a vector where an agent could be coerced into exfiltrating sensitive system configuration or credentials to an attacker-controlled repository.
[CREDENTIALS_UNSAFE]: The script is designed to programmatically discover and utilize sensitive GitHub access tokens from multiple sources, including environment variables like MOVIEPILOT_GITHUB_TOKEN, GITHUB_TOKEN, and GH_TOKEN, as well as project-specific configuration files. This represents a broad credential handling surface that could be targeted for harvesting.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources during pull operations, which could introduce malicious content into the local environment.
Ingestion points: The script fetches file contents and package.json metadata from remote GitHub repositories via the Contents API.
Boundary markers: The skill relies on JSON structure validation but does not utilize specific boundary markers or "ignore" instructions for the content of the downloaded files.
Capability inventory: The skill has access to write_file and execute_command, and the script itself performs local file writes to synchronize remote changes.
Sanitization: While the script validates that the metadata is valid JSON, it does not sanitize the contents of the files (e.g., scripts or configuration) before writing them to the local filesystem. Overwrites are protected by default but can be enabled using the --force flag.
[COMMAND_EXECUTION]: The skill uses execute_command to run a Python script that performs network operations and file system modifications. This script accepts multiple arguments, including paths and repository names, which could be exploited if the agent fails to properly validate user-supplied input before passing it to the command line.

publish-moviepilot-plugin