The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform shell commands including npm run plugin:sync and npm run plugin:build. These operations are integral to the stated purpose of managing the lifecycle of CodeModeKit plugins and occur within the local project environment.
[DATA_EXPOSURE]: The instructions in references/discovery.md and references/plugin-maintenance.md require the agent to audit project files, including .env and package.json. The skill demonstrates security best practices by explicitly instructing the agent to ensure secrets are not included in the dist/ directory during the build process.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where it ingests data from external sources such as repository source code (src/server.mjs) and documentation to generate agent instructions. While this poses a theoretical risk for indirect prompt injection if the source repository contains malicious strings, the skill incorporates an evaluation step (references/evaluation.md) to verify behavior before deployment.

author-codemode-skill