The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on several shell scripts (multi_linter.sh, protect_linter_configs.sh, stop_config_guardian.sh) configured as PreToolUse and PostToolUse hooks. These scripts execute automatically on every file edit or shell command, providing a mechanism for silent code modification and environment monitoring.
[REMOTE_CODE_EXECUTION]: The 'Phase 3: Delegate + Verify' architecture spawns claude -p subprocesses to autonomously attempt code fixes. This creates a secondary execution loop where the agent's output is processed by another model instance without direct user oversight of the intermediate prompts.
[COMMAND_EXECUTION]: The skill implements a 'Package Manager Enforcement' hook that intercepts and blocks standard system commands like pip, npm, and poetry. This restricts the agent's environment and forces the use of specific tools (uv, bun), which could be used to steer the agent toward specific dependency resolution paths.
[EXTERNAL_DOWNLOADS]: The documentation requires manual installation of external dependencies and the Plankton repository itself. It references several third-party tools including jaq, ruff, uv, biome, shellcheck, and hadolint which must be installed on the host system.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in its Phase 3 delegation. It passes structured linter violations (JSON) to a subprocess Claude model. If an attacker can craft code that triggers specific linter messages, they may be able to influence the instructions provided to the subprocess model.
Ingestion points: Linter violation messages generated from file edits (SKILL.md).
Boundary markers: None identified in the provided configuration for the claude -p prompt construction.
Capability inventory: The subprocess has the capability to write to the local filesystem to 'fix' violations.
Sanitization: No evidence of sanitization or escaping of linter messages before they are passed to the subprocess model.

plankton-code-quality