The Agent Skills Directory

[DYNAMIC_EXECUTION]: The evaluation script evals/check_wait_rule.py extracts shell command snippets directly from SKILL.md using regular expressions and executes them via subprocess.Popen(["bash", "-c", script]). This design allows documentation content to be executed as code, which could be exploited by embedding malicious shell commands within the markdown file.
[PERSISTENCE]: The skill maintains cross-session state by writing "lessons" to a local directory at ${AGENT_LESSONS_DIR:-$HOME/.local/state/agent-lessons}/task-completion-loop/. This mechanism allows the agent to store and retrieve data that persists outside the scope of individual project repositories, potentially influencing the agent's logic across different tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as project plans, specifications, and codebase contents, to drive its task-completion orchestration.
Ingestion points: The skill reads repository-specific plans and code snapshots during Phase 0 to construct its work ledger.
Boundary markers: It attempts to mitigate risk by defining a "frozen scope" and "exclusion paths" (e.g., .git/**) to restrict the agent's modification capabilities.
Capability inventory: The skill possesses significant capabilities, including executing shell commands via the review-loop CLI, performing file writes to the working tree, and coordinating multi-agent sessions.
Sanitization: No explicit static sanitization or escaping of ingested data is implemented; the skill instead relies on multi-agent "Peer" reviews and blind audits to verify the safety and correctness of the generated logic.

task-completion-loop