The Agent Skills Directory

[Data Exposure & Exfiltration] (SAFE): The skill performs read and write operations on local JSON and Markdown files. These operations are restricted to the marketplace root directory provided by the user. No credentials, sensitive system files, or network exfiltration patterns were detected.\n- [Unverifiable Dependencies & Remote Code Execution] (SAFE): The provided Python scripts use only the Python standard library. No external packages are required, and there is no downloading or execution of remote scripts.\n- [Indirect Prompt Injection] (SAFE): The skill allows the creation of plugins with user-defined descriptions and metadata. 1. Ingestion points: CLI arguments in create_plugin.py and bump_version.py. 2. Boundary markers: None. 3. Capability inventory: Local file and directory management (mkdir, open, json.dump). 4. Sanitization: None. While the tool processes untrusted strings, it does so for the purpose of local scaffolding and does not expose the agent to cross-domain injection or elevated privilege risks.\n- [Dynamic Execution] (SAFE): The skill generates files using static templates and standard JSON serialization. No dynamic code generation or runtime compilation techniques were found.

plugin-forge