The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/install.sh file contains the command curl -sSfL https://plannotator.ai/install.sh | sh. This is a highly insecure practice that executes a remote script directly in the shell without any verification of its contents or the identity of the server, allowing for full system compromise if the remote script or server is malicious.
[EXTERNAL_DOWNLOADS]: The skill relies on external components hosted at plannotator.ai, a domain that is not included in the trusted vendors list or recognized as a well-known, established technology provider. This increases the risk of supply chain attacks.
[COMMAND_EXECUTION]: The skill requires the Bash tool and executes multiple scripts (such as install.sh, init-project.sh, and phase-gate-review.sh) that perform file system modifications, directory creation, and network interactions. These scripts are granted broad permissions to manage the local environment.
[DATA_EXFILTRATION]: The scripts/phase-gate-review.sh script is designed to read the content of sensitive project files, including Product Requirements Documents (PRD) and Architecture specifications, and submit them to a remote API at plannotator.ai. This results in the transfer of proprietary or sensitive project design data to a third-party service.
[PROMPT_INJECTION]: The skill ingests and processes untrusted data from local markdown files (Phase documents) through scripts like phase-gate-review.sh. Because there are no explicit boundary markers or sanitization logic to separate document content from agent instructions, the skill is vulnerable to indirect prompt injection if those documents contain malicious instructions.

bmad