The Agent Skills Directory

[Unverifiable Dependencies & Remote Code Execution] (HIGH): The skill utilizes bunx @plaited/development-skills to perform its actions. This command downloads and executes code from the npm registry at runtime. The @plaited scope is not an established trusted source, posing a supply chain risk where malicious code could be executed on the user's machine.
[Indirect Prompt Injection] (HIGH): The skill's primary function is to populate .claude/rules, .cursor/rules, and .agents/rules with instructions from an external package. These directories are used by AI agents to define their behavior. Malicious instructions injected into these files can persistently subvert the agent's safety protocols or operational logic across all future sessions in that workspace.
Ingestion points: External rules are fetched via bunx from the @plaited/development-skills package.
Boundary markers: Absent. The skill does not provide any mechanism to delimit or warn the agent about the untrusted nature of the rules being applied.
Capability inventory: Uses the Bash tool to execute shell commands and performs file system modifications in project configuration directories.
Sanitization: Absent. There is no validation or human-in-the-loop review of the rules before they are symlinked or copied into the agent's instruction path.
[Persistence Mechanisms] (MEDIUM): By modifying the rules that govern the AI agent's environment, the skill establishes a form of logic persistence that survives the end of the current task, potentially affecting all subsequent interactions between the user and the agent.

scaffold-rules