engineering-skills

Detailed technical analysis:

• [COMMAND_EXECUTION]: Multiple scripts within the collection (e.g., gws_recipe_runner.py, pr_analyzer.py, workspace_audit.py, gws_doctor.py) use subprocess.run() to interface with local CLI tools like git and gws. The use of shell=True in gws_recipe_runner.py to execute command strings from the predefined recipes increases the risk of command injection if the script were modified or if templates were expanded with unsanitized user input.
• [PERSISTENCE]: The self-improving-agent skill includes the /si:promote command, which allows the agent to graduate observations from auto-memory (MEMORY.md) into permanent, high-priority instructions in CLAUDE.md or .claude/rules/. This creates a mechanism where learned behaviors—potentially including those picked up from poisoned data—can be made permanent and significantly alter the agent's future behavior within the project.
• [INDIRECT_PROMPT_INJECTION]: Core components of the suite, specifically the code-reviewer and incident-commander skills, are designed to read and process untrusted external data such as Pull Request diffs, source code files, and incident logs. The current configuration lacks strict boundary markers or 'ignore instructions' delimiters for this ingested data, making the agent vulnerable to instructions embedded within the codebase being reviewed.
• [DYNAMIC_EXECUTION]: Several tools perform dynamic code and script generation. senior-backend generates Express.js route handlers and validation logic, while ms365-tenant-manager and user_management.py generate PowerShell scripts for administrative operations. While intended for developer productivity, these generated artifacts require careful human review before being executed or integrated into production codebases as they represent an automated code generation vector.