Agent Development for Claude Code Plugins

Agents are explicitly allowed to use the `Bash` tool, granting arbitrary command execution capabilities. This poses a critical risk for reverse shells, data exfiltration, persistence, privilege escalation, and system compromise.

`tools: ["Read", "Write", "Grep", "Bash"]`, `Common tool sets: ... ["Read", "Bash", "Grep"]`

If the `tools` field is omitted, agents default to having access to all tools, including `Bash` and `Write`. The `Write` tool allows file modification, which can be used for persistence, data manipulation, or resource abuse.

`Default: If omitted, agent has access to all tools`, `tools: ["Read", "Write", "Grep"]`

The `description` and `system prompt` fields are user-defined and directly control agent triggering and behavior. Malicious input in these critical fields can lead to prompt injection, semantic manipulation, or hidden instructions, potentially bypassing safety mechanisms.

`description (required) ... This is the most critical field.`, `The markdown body becomes the agent's system prompt.`