The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party plugin data (manifests, descriptions, and commands) which could theoretically be used to influence the generation process. However, the scripts implement significant mitigations:
Ingestion points: scripts/analyze.py and scripts/convert.py read .claude-plugin/plugin.json, hooks/hooks.json, and SKILL.md from the provided source directory.
Boundary markers: External strings are wrapped using yaml_quote for YAML output and Python's repr() (using the !r format specifier) for Python literals in generated files.
Capability inventory: The resulting plugin generated by the skill has access to shell execution (subprocess.run), network requests (httpx), and the agent's internal tool/skill registration context.
Sanitization: A safe_name utility is used consistently to sanitize names for file system use, preventing path traversal. Additionally, a heuristic-based redaction function (_redact_credential_value) attempts to identify and mask secrets like API keys in configurations.
[DYNAMIC_EXECUTION]: The primary function of the skill is to generate executable Python code (__init__.py, hooks.py) and configuration files based on input data. While this is the intended purpose of the tool, generating executable logic from untrusted external data is a high-risk pattern.
[COMMAND_EXECUTION]: The conversion process generates Python code that utilizes subprocess.run(..., shell=True, ...) to implement hook logic defined in the source Claude plugin. This creates a surface for shell command execution in the final generated product.

claude-plugin-converter