The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation process described in scripts/install.sh and SKILL.md uses the curl -fsSL https://plannotator.ai/install.sh | bash pattern, which executes unverified remote code with the current user's privileges.
[COMMAND_EXECUTION]: Setup scripts including setup-hook.sh, setup-gemini-hook.sh, and setup-codex-hook.sh modify configuration files such as ~/.claude/settings.json, ~/.gemini/settings.json, and ~/.codex/config.toml to add execution hooks. These hooks are designed to trigger the plannotator command automatically whenever specific agent modes are exited, providing the skill with persistent execution capabilities.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes scripts from https://plannotator.ai. This domain is not identified as a trusted vendor or well-known technology service.
[DATA_EXFILTRATION]: The skill provides a feature to share plan reviews via share.plannotator.ai. This involves uploading local git diffs and implementation plans, which may contain sensitive source code or internal project details, to an external server.
[COMMAND_EXECUTION]: The scripts/configure-remote.sh script modifies shell profile files such as .zshrc and .bashrc to inject environment variables, which is a technique used to persistently alter the user's shell environment.

plannotator