The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains multiple instructions designed to override the agent's standard safety and interaction protocols. It explicitly commands the agent to be "non-interactive, fully automated," and "NOT ask for confirmation at any step," suppressing the user's ability to review or stop operations.
[COMMAND_EXECUTION]: The skill reads and executes arbitrary shell commands from the .context/ship-config.json file via the test_commands and eval_commands fields. This creates a high-risk vector where malicious code stored in the repository's configuration would be executed on the user's machine without any interaction.
[DATA_EXFILTRATION]: The skill attempts to read files located outside the current working directory, specifically targeting ~/.claude/skills/review/checklist-base.md. Accessing configuration or metadata files from the user's home directory can lead to unintended data exposure.
[COMMAND_EXECUTION]: The skill automatically detects and executes build and test commands (e.g., make test, npm test, pytest) based on the presence of project files. While standard, executing these automatically in a "non-interactive" mode without user review is a security concern if the repository's build scripts are compromised.
[COMMAND_EXECUTION]: The workflow relies on the gh (GitHub CLI) tool for network-based operations such as checking CI status and creating pull requests, all performed without user confirmation as part of the automated workflow.

ship