The Agent Skills Directory

Restricted Shell Execution: The skill uses a restricted set of pre-approved Bash commands (e.g., git, python3, find, mkdir) for scanning and report generation. Commands are executed as single, simple calls to prevent shell-injection patterns like command chaining.
Dynamic Context and Argument Injection: The skill uses !date and !find to populate report timestamps and metadata. It also processes $ARGUMENTS to determine the user's intended job. These inputs flow into subsequent Bash calls, such as the write_scan_meta.py and patch_artifacts.py scripts. While this introduces a potential for command injection, the skill specifically enforces strict validation (e.g., checking git ref shapes) and uses fixed environment variables (GIT_TERMINAL_PROMPT=0) to mitigate risks.
Local Script Execution: The skill invokes Python scripts located in the ${CLAUDE_PLUGIN_ROOT}/scripts directory. These scripts are responsible for critical tasks like rendering reports and preparing patch artifacts. Because these scripts are part of the plugin root and not downloaded from remote sources at runtime, they are considered part of the skill's trusted infrastructure.
User Confirmation Safeguards: For potentially expensive or long-running tasks (like a full codebase scan), the skill implements a mandatory 'Confirm' menu. This ensures the user is aware of token costs and time commitments before execution begins.
Indirect Prompt Injection Surface: The skill processes untrusted data from the repository being scanned (code, comments, and PR titles). However, it includes explicit instructions to treat all repository content as data under review rather than instructions. It also uses independent verifier panels to challenge findings, which acts as a secondary layer of protection against poisoned outputs.

claude-security