The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches files from the EveryInc/compound-engineering-plugin and obra/superpowers GitHub repositories using the gh CLI. These sources are not recognized as trusted or well-known services. The downloaded content includes executable assets such as scripts/setup.sh and scripts/generate.py which are placed into the local skill directory.
[REMOTE_CODE_EXECUTION]: By downloading executable scripts from untrusted external repositories and instructing the agent to place them in the local directory, the skill creates a path for remote code execution. The subsequent verification instructions (bun run build, bun test) may trigger the execution of these unverified scripts if they are integrated into the project's build or test suites.
[COMMAND_EXECUTION]: The skill uses extensive shell commands, including gh, sed, bun, jq, and shasum, to manipulate files and project structure. It performs recursive string replacements (sed -i) and directory operations based on content retrieved from external APIs, which increases the attack surface for command injection if the upstream content is maliciously crafted.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests definitions (agents, skills, commands) from external sources—which are themselves natural language instructions—and feeds them to an LLM for an "intelligent rewrite" pass. The instructions do not include boundary markers or sanitization logic to prevent malicious instructions embedded in the upstream source from subverting the conversion process or the resulting Systematic plugin's behavior.

convert-cc-defs