The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to indirect command injection through user-provided data.
Ingestion points: Plugin name and category gathered via AskUserQuestion in references/phase0-discovery.md.
Boundary markers: None; input is directly assigned to shell variables.
Capability inventory: Extensive use of Bash for directory creation, git operations, and package management in references/phase1-scaffold.md and references/phase4-release.md.
Sanitization: Absent; user-provided variables like $PLUGIN_NAME are interpolated directly into shell strings (e.g., mkdir -p plugins/$PLUGIN_NAME and git commit -m "feat($PLUGIN_NAME)..."), which allows execution of arbitrary commands if the user provides input containing shell metacharacters.
[DATA_EXFILTRATION]: The skill accesses sensitive credentials by executing gh auth token in references/phase4-release.md. While this is intended to facilitate automated releases via npm run release, retrieving active authentication tokens into the agent's environment is a high-privilege operation that could be abused if the agent is redirected to a malicious registry or endpoint.

create