The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze third-party plugin source code and configuration files. Because the skill has the capability to execute shell commands and modify the local filesystem, this creates an attack surface where malicious instructions embedded in a scanned plugin's codebase or metadata could attempt to influence the agent's behavior.
Ingestion points: The scripts/plan-migration.mjs and scripts/inject-lint.mjs tools read and parse content from user-specified plugin repositories.
Capability inventory: The scripts/verify-runtime.mjs utility executes shell commands via dsh, npm, and pnpm. The SKILL.md instructions allow the agent to modify local configuration and source files in its update and migration modes.
Boundary markers: The instructions lack explicit delimiters or specific warnings to ignore embedded instructions within the processed plugin data.
Sanitization: Content is evaluated using heuristic regex patterns without explicit sanitization or isolation before processing.
[REMOTE_CODE_EXECUTION]: The verify-runtime.mjs utility performs runtime verification by installing and booting plugins in an isolated profile. This process downloads and executes third-party code, including potentially untrusted installation lifecycle scripts.
Evidence: scripts/verify-runtime.mjs uses dsh plugin add to install code from npm or Git URLs. The script includes logic to automatically approve and execute build scripts via the --allow-build flag and pnpm approve-builds commands.
[COMMAND_EXECUTION]: The skill relies on multiple utility scripts that execute shell commands to interact with the system environment and the DSH host.
Evidence: scripts/ghost-host-check.mjs runs ps and git commands. scripts/plan-migration.mjs runs stat. scripts/verify-runtime.mjs executes dsh, git, npm, and pnpm binaries.

plugin-upgrade