The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a workflow that parses shell commands from CLAUDE.md files within the workspace and executes them. In a multi-repo environment, this allows an attacker to gain code execution on the agent's host by placing malicious commands in a repository that the agent is instructed to process.
- Evidence: Step 1 of the multi-repo mode instructions uses grep and sed to extract commands from CLAUDE.md and then executes them within a bash heredoc: ${INSTALL_CMD} and ${POSTINSTALL_CMD}.
[COMMAND_EXECUTION]: The skill frequently uses shell command execution to manage the git environment, verify paths, and run build/test cycles.
- Evidence: Multiple bash <<EOF blocks are used to execute shell scripts for workspace verification, dependency installation, and git-spice operations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external files like specifications, plans, and constitutions and interpolates them directly into the instructions for subagents without using robust delimiters or safety warnings.
- Ingestion points: CLAUDE.md (setup commands), specs/{run-id}-{feature-slug}/spec.md (requirements), and specs/{run-id}-{feature-slug}/plan.md (task boundaries).
- Boundary markers: The skill does not use unique delimiters or explicit instructions to ignore potentially malicious embedded content within the interpolated variables.
- Capability inventory: Subagents have the ability to write files and execute arbitrary shell commands via build and test scripts.
- Sanitization: No sanitization is performed on the ingested text beyond simple backtick removal, which is insufficient to prevent injection.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes shell scripts at runtime based on the contents of files found in the working directory.
- Evidence: The extraction of INSTALL_CMD and POSTINSTALL_CMD from a text file and their subsequent execution in a subshell represents a dynamic execution pattern that bypasses static code analysis of the skill's intended behavior.

executing-sequential-phase