The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for users to run shell commands for typechecking and testing using the Bun runtime.
Evidence: Commands such as bunx -p typescript@7.0.2 tsc --noEmit -p . and bun test are documented in SKILL.md for plugin validation.
[INDIRECT_PROMPT_INJECTION]: The skill documents the process for installing and running third-party code, which creates a potential surface for indirect injection if malicious repositories are used.
Ingestion points: Plugin folders and external Git or archive URLs provided during installation (Step 6 of SKILL.md).
Boundary markers: A trust prompt is required in the host application before a plugin is enabled (Step 5 of SKILL.md).
Capability inventory: The plugin environment supports network requests (fetch), file access (sidedoor.open, Bun.file), system notifications, and persistent storage access.
Sanitization: The installation workflow utilizes bun install --ignore-scripts to prevent the execution of malicious lifecycle scripts during dependency resolution.
[EXTERNAL_DOWNLOADS]: The documentation refers to official resources and examples hosted on GitHub for developer reference.
Evidence: The skill links to github.com/lassejlv/sidedoor/blob/main/sdk/README.md and github.com/lassejlv/sidedoor/tree/main/sdk/examples/plugins/pomodoro as official repositories for the Sidedoor SDK and examples.

sidedoor-plugins