The Agent Skills Directory

[COMMAND_EXECUTION]: Unsafe execution of shell commands in scripts/loop_controller.py.
The cmd_verify function uses subprocess.run(chk["cmd"], shell=True, ...) to execute verification checks.
The commands are retrieved from the state.json file, which is initialized from a plan.json file.
This pattern allows for arbitrary code execution if an attacker can influence the content of the plan or state files.
[DYNAMIC_EXECUTION]: The skill's architecture is based on loading executable instructions from data files.
loop_controller.py dynamically loads and executes logic provided in JSON format, bypassing static instruction analysis for the runtime commands.
[INDIRECT_PROMPT_INJECTION]: The skill has a large surface for indirect injection in scripts/goal_compiler.py.
Ingestion points: Untrusted data enters the context via the --goal CLI argument in goal_compiler.py.
Boundary markers: Absent. The goal text is directly interpolated into the task objective string (e.g., "Apply skill '...' toward goal: [GOAL_TEXT]").
Capability inventory: The skill has high-privilege capabilities including arbitrary shell command execution via loop_controller.py.
Sanitization: Absent. The raw goal string is used in the plan generation without escaping or filtering malicious natural language instructions.

agent-harness