The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via the Bash tool (e.g., codex exec ... "<brief>") where the <brief> content is dynamically constructed from external project documents like task definitions and git diffs. There are no instructions for sanitizing or escaping this input, which creates a command injection risk if project files contain shell metacharacters like backticks, semicolons, or dollar signs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from 01-requirements.md and 04-dev-tasks.md to drive task execution and passes this data to sub-agents (Test Agent and Impl Agent). It lacks explicit sanitization or security-focused boundary markers to prevent instructions embedded in these documents from being interpreted as commands by the sub-agents. * Ingestion points: Development documents (01-requirements.md, 04-dev-tasks.md). * Boundary markers: Missing security-specific delimiters for data interpolated into prompts; existing barriers only serve logic and information isolation. * Capability inventory: Significant file system access and shell execution capabilities through Bash, Write, and Edit tools. * Sanitization: No evidence of sanitization for externally sourced content.
[DYNAMIC_EXECUTION]: The skill performs runtime generation and execution of code and tests. While standard for a developer agent, the vulnerability in shell command construction from untrusted documentation increases the risk that generated commands could be manipulated by malicious document content.

dev-workflow