The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a dedicated utility (verify-runtime.mjs) to install and cold-boot plugins for compatibility verification. This process involves executing installation and lifecycle scripts from the plugin being tested. This capability is explicitly documented as a dynamic verification step and is accompanied by prominent security warnings advising users to run untrusted code in isolated environments like Docker containers.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves scanning and reading untrusted plugin source code and configuration. This creates a surface for indirect prompt injection. The skill mitigates this risk by employing heuristic scripts (plan-migration.mjs) that identify touchpoints using regex patterns without outputting the full content of matching lines, and by instructing the agent to require user confirmation before any writes or executions.
[COMMAND_EXECUTION]: The provided diagnostic utilities execute standard system and platform commands including dsh, npm, git, and ps. These commands are used for environment identification, dependency resolution, and process management, which are all task-aligned for a developer utility.
[EXTERNAL_DOWNLOADS]: The runtime verifier and migration planner can fetch external packages and clone repositories to facilitate testing and dependency inventory. These operations are intended for the primary purpose of plugin management and migration.

plugin-upgrade