The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data, including plugin descriptions, tags, and localized introduction highlights fetched from the dshfind gateway (https://api.dshfind.com). This third-party content is analyzed to determine capability coverage.
Ingestion points: scripts/search_plugin.py retrieves metadata and details for multiple candidate plugins.
Boundary markers: The analysis workflow in SKILL.md and references/fit-analysis.md lacks explicit boundary markers or instructions to treat the fetched metadata as untrusted data.
Capability inventory: The skill has access to the local file system (writing new-plugin briefs to the workspace and profile records to user config), network access, and the ability to execute its own scripts via shell.
Sanitization: scripts/profile_store.py contains a SENSITIVE_PARTS filter to prevent the persistence of secret-like strings (tokens, passwords, api_keys) into the long-term user profile.
[COMMAND_EXECUTION]: The workflow requires the agent to execute multiple local Python scripts for searching (search_plugin.py), persisting state (profile_store.py), and validating source integrity (validate_skill.py). All scripts use standard library components for execution, with the exception of the validation script which requires PyYAML.
[SAFE]: The network operations are directed at the vendor's official API (https://api.dshfind.com), which is a public, read-only service for plugin discovery.

dsh-search-or-create-plugin