The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install.sh contains a high-risk command pattern: curl -sSfL https://plannotator.ai/install.sh | sh. This downloads a script from an untrusted internet source and executes it directly with shell privileges, which could be exploited to compromise the host system.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of third-party tools from unverified sources, including the plannotator CLI and references to fabric and npx skills add commands targeting non-trusted repositories.
[DATA_EXFILTRATION]: In scripts/phase-gate-review.sh, the skill pipes the entire content of project documents (PRDs, Architecture specs, and Tech Specs) to the plannotator submit command. This sends potentially sensitive intellectual property and technical secrets to an external server (plannotator.ai) that is not on the trusted vendor list.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection. Ingestion points: Document files processed by scripts/phase-gate-review.sh and piped to fabric. Boundary markers: Absent in scripts. Capability inventory: Shell execution in scripts/install.sh and network data transmission in scripts/phase-gate-review.sh. Sanitization: Absent; the content of documents is passed directly to external utilities.
[COMMAND_EXECUTION]: The script scripts/phase-gate-review.sh uses python3 -c to execute a wrapper script that spawns subprocesses. This execution style increases complexity and can be used to bypass simple string-based command detection.

bmad