The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates shell commands for the user to execute (/plugin marketplace add <marketplace>). The <marketplace> value is sourced dynamically from local JSON files in hooks/recommendations/. If these files are compromised or part of a malicious repository, they can trick the user into adding untrusted plugin marketplaces.
[EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external software components. It instructs the agent to search for, recommend, and provide installation paths for plugins based on unverified local metadata, which could lead to the execution of untrusted code if the recommendation files are malicious.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing untrusted data to influence tool selection and command generation.
Ingestion points: Untrusted user input is captured via $ARGUMENTS, and potentially untrusted metadata is read from hooks/recommendations/*.json files.
Boundary markers: No delimiters or "ignore instructions" guards are present when passing user-provided descriptions to the Skill tool in Step 4.
Capability inventory: The skill has the ability to invoke other skills via the Skill tool and provide shell command instructions to the user.
Sanitization: There is no evidence of sanitization or validation for the plugin names, marketplace strings, or user-provided descriptions before they are interpolated into tool calls or shell commands.

create