The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Plate registry changelog JSON files, which may contain fields intended for human reading but processed by the agent.
Ingestion points: Reads files from apps/www/src/registry/changelog/*.json and the target project's source files.
Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between data to be processed and instructions to be ignored within the changelog metadata (e.g., migration notes, diagnostics).
Capability inventory: The skill possesses the capability to modify local source files, update package configurations, and execute verification commands (lint/test) via the shell.
Sanitization: No sanitization or validation of the content within the changelog or source files is performed before they are used to influence the agent's actions.
[COMMAND_EXECUTION]: The skill executes commands within the context of a target repository which could contain malicious configurations.
Evidence: During the apply mode, the agent is instructed to "run focused target verification" and "update target package versions with the target package manager and lockfile."
Risk: If a target project repository contains a malicious package.json or modified test/lint scripts, the agent's execution of these standard development commands could lead to local code execution outside the intended scope of the UI sync.

sync-plate-ui