The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill contains an implementation pattern in references/update-notifications.md for checking plugin updates by fetching metadata from the npm registry (registry.npmjs.org). This is a well-known service used for its intended purpose of version discovery.
[COMMAND_EXECUTION]: The skill provides code examples in references/examples.md and references/hook-patterns.md that use the Bun Shell ($) to execute system commands such as osascript (for macOS notifications), wc (word count), and eslint. These are presented as standard functional templates for plugin developers.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a developer assistant that generates TypeScript plugin code based on user-supplied requirements. This creates an indirect prompt injection surface where malicious instructions in a user prompt could influence the generated plugin logic.
Ingestion points: User prompts describing desired plugin functionality.
Boundary markers: The instructions do not define specific delimiters or warnings for user-provided instructions.
Capability inventory: Generated plugins have the capability to intercept tool calls, execute shell commands, and perform network requests.
Sanitization: The skill emphasizes type safety and modularity but does not prescribe specific sanitization for the inputs used to generate the plugin logic.

opencode-build-plugins