The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it trusts data ingested from external files. It uses the Glob and Read tools to scan *.json files within hooks/recommendations/ and uses the marketplace and description fields from these files to determine its logic.
Ingestion points: Recommendation JSON files located in hooks/recommendations/ (SKILL.md, Step 1).
Boundary markers: None. The content of these files is treated as authoritative and interpolated directly into logic and user prompts.
Capability inventory: The skill generates executable shell commands (/plugin marketplace add) and can invoke other agent skills via the Skill tool (SKILL.md, Steps 3 and 4).
Sanitization: No validation or sanitization is performed on the marketplace strings or plugin descriptions retrieved from the local files.
[PROMPT_INJECTION]: User input provided via $ARGUMENTS is placed inside a <description> tag without boundary markers or escaping, which could allow a user to inject instructions that manipulate the plugin selection logic.
[COMMAND_EXECUTION]: The skill constructs and displays platform commands (/plugin marketplace add <marketplace>) to the user. Since the <marketplace> variable is sourced from unverified local configuration files, a malicious file could trick a user into adding an untrusted marketplace or repository to their environment.

create