The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically parses and executes shell commands from external configuration files. Specifically, it extracts installation, linting, and testing commands from CLAUDE.md using grep and sed, then executes them via bash -c or heredoc blocks. This pattern allows for arbitrary command execution if an attacker can influence the content of the CLAUDE.md file within a repository.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection as it ingests untrusted data from multiple repository files to drive agent behavior.
Ingestion points: Reads instructions and commands from CLAUDE.md, plan.md, and spec.md (located in the analyzed repository).
Boundary markers: Uses clear text delimiters like '===== PHASE BOUNDARIES
CRITICAL =====' in subagent dispatches, which helps mitigate but does not eliminate injection risks.
Capability inventory: The skill has capabilities to create/delete directories (worktrees), create git branches, and execute shell scripts through subagents.
Sanitization: There is minimal sanitization of the commands extracted from CLAUDE.md beyond basic string manipulation, leaving the agent vulnerable to maliciously crafted command strings.
[PROMPT_INJECTION]: The 'Autonomous Execution' section contains instructions to 'NEVER ask user what to do' and to suppress user prompts even during failures or architectural uncertainties. While intended to facilitate automation, this behavior effectively removes human-in-the-loop oversight, which is a common pattern targeted by adversarial instructions to ensure malicious actions proceed without interruption.

executing-parallel-phase