The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/convert.py script generates Python source code for the converted plugin using f-strings without consistent application of repr() or string escaping for all external fields. Specifically, the convert_hooks function directly interpolates a hook's URL into an httpx.post call using double quotes, and the convert_commands function interpolates command names. If an input plugin contains a URL or filename with crafted double quotes and Python syntax, it could escape the intended string literal and execute arbitrary Python code when the generated plugin is loaded.
[COMMAND_EXECUTION]: The converter is designed to generate hooks.py files that utilize subprocess.run(..., shell=True, ...) to execute shell commands originally defined in the Claude plugin. While this is the intended functionality of the tool and is accompanied by prominent security warnings in SKILL.md, it creates a direct pathway for command execution that relies entirely on the user's manual auditing of the generated output.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party plugin manifests and markdown files which act as the source for generated executable code.
Ingestion points: Reads .claude-plugin/plugin.json, hooks.json, and SKILL.md from user-specified plugin directories.
Boundary markers: The generated output lacks logical boundaries or comment-based warnings between the boilerplate registration code and the untrusted command strings.
Capability inventory: The converter possesses file system write capabilities to create the new plugin, and the generated output includes shell execution (subprocess.run) and network requests (httpx).
Sanitization: The skill uses a safe_name utility to prevent path traversal during directory creation and uses repr() for shell command strings, but fails to apply these protections to URLs and command names in the generation logic.

claude-plugin-converter