The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an unverified GitHub account (alexfazio/plankton) to obtain its core logic.
[COMMAND_EXECUTION]: The skill architecture relies on executing multiple shell scripts (multi_linter.sh, protect_linter_configs.sh, stop_config_guardian.sh) as part of tool hooks.
[REMOTE_CODE_EXECUTION]: In Phase 3 ('Delegate + Verify'), the skill automatically spawns agent subprocesses to interpret violation data and perform code modifications. This creates a recursive loop where untrusted data (linter outputs or file content) can influence the instructions given to the subprocess agent.
[COMMAND_EXECUTION]: The setup instructions include system-level package installation via brew install jaq ruff uv and direct execution of uv sync --all-extras, which installs unversioned Python dependencies from the cloned repository.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: The multi_linter.sh hook processes the content of any file edited by the main agent.
Boundary markers: There are no documented boundary markers or warnings to the subprocess agent to ignore embedded instructions within the code it is tasked to 'fix'.
Capability inventory: The system has broad capabilities, including subprocess spawning, file-writing via formatters, and network access (implied by uv sync and potential model API calls for the 'fixer' agents).
Sanitization: The skill does not describe any sanitization or validation of the violation JSON before it is passed to the subprocess agent.

plankton-code-quality