The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-edited code files through a multi-phase linting and remediation pipeline. In Phase 3 (Delegate + Verify), the tool spawns a subprocess agent (claude -p) and provides it with structured JSON containing linter violations to perform automated fixes. This creates a surface where malicious instructions embedded in the code being linted could theoretically influence the behavior of the remediating agent.
Ingestion points: Every file edit performed by the main agent (detected via PostToolUse hooks).
Boundary markers: The skill documentation mentions structured JSON format, but does not explicitly detail prompt delimiters or 'ignore' instructions for the subprocess.
Capability inventory: The subprocess has the capability to modify project files to fix violations.
Sanitization: No explicit sanitization of the code content or linter messages is described before being passed to the subprocess agent.
[COMMAND_EXECUTION]: The skill uses PreToolUse hooks to intercept and block specific shell commands (legacy package managers like pip, npm, yarn, poetry) in favor of newer tools (uv, bun). While this is an enforcement mechanism, it involves monitoring and restricting the agent's command execution environment.
[DYNAMIC_EXECUTION]: The skill utilizes 'Subprocess Delegation' to dynamically spawn model-specific agents (Haiku, Sonnet, Opus) to execute code modifications at runtime based on the complexity of detected violations.

plankton-code-quality