The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines the architecture for data ingestion and environment interaction, which constitutes a standard attack surface for indirect prompt injection if data from external environments is not sanitized by the plugin author.
Ingestion points: Data enters through the trajectory_collect hook and the results of environment capabilities like exec and attach_stdio defined in SKILL.md and references/authoring.md.
Boundary markers: The documentation does not specify mandatory boundary markers for external data, although it references a strict protocol schema (ageval.trajectory.event/1).
Capability inventory: Plugins can request access to capabilities including exec, upload, download, and attach_stdio as listed in the inject section of the plugin.yaml manifest.
Sanitization: Sanitization is handled at the implementation level of the specific plugin hooks; the documentation focuses on the architectural binding rather than data validation logic.
[COMMAND_EXECUTION]: The documentation describes a plugin system that utilizes command execution capabilities (exec) to interact with worker containers. These are documented as core features of the executor and environment plugin types, intended for use with defined platforms like Docker, E2B, and SSH.

ageval-plugin