The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to fetch a plugin manifest and a ZIP archive from an unverified third-party GitHub repository (ZL154/JellyfinSecurity).
[REMOTE_CODE_EXECUTION]: The manual installation instructions facilitate the download and extraction of potentially arbitrary code into a server's plugin directory, which is executed when the host service restarts.
[COMMAND_EXECUTION]: The documentation provides a shell snippet that uses curl to download a ZIP file and unzip to extract it into the system's plugin directory (/var/lib/jellyfin/plugins/).
[PRIVILEGE_ESCALATION]: The installation process involves executing commands like chown and systemctl restart, which modify system-level file ownership and control background services, requiring administrative access.
[INDIRECT_PROMPT_INJECTION]: The skill processes external authentication data (OIDC claims) and logs (audit events), which could act as a vector for malicious instructions if the upstream identity provider or user accounts are compromised.
Ingestion points: OIDC callback parameters and audit log query services (AuditLogService).
Boundary markers: None explicitly defined in the configuration or implementation examples to delimit untrusted data.
Capability inventory: Shell command execution (installation scripts), file writes (plugin configuration), and network operations (OIDC and SMTP).
Sanitization: While k-anonymity is mentioned for password hashing, no specific sanitization is described for OIDC userinfo claims before they are integrated into the system context.

jellyfin-security-plugin