The Agent Skills Directory

[DYNAMIC_EXECUTION]: The modules/insight-generation.md module uses a python3 -c command to execute a script that interpolates shell variables ($INSIGHT_TYPE, $SUMMARY, $EVIDENCE, etc.) directly into a Python string literal. Because the $EVIDENCE variable is populated with raw code snippets from the project under analysis, an attacker can plant crafted code that breaks the string literal to execute arbitrary Python code on the host system.
[COMMAND_EXECUTION]: The skill employs extensive shell pipelines involving grep, awk, and sed. The execution of the insight-generation module's script is particularly hazardous due to the lack of variable sanitization before execution in a shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill scans untrusted project files and extracts snippets to guide the agent's refactoring and execution actions.
Ingestion points: Snippets are extracted from *.py, *.ts, *.rs, and *.go files using grep and sed across multiple modules.
Boundary markers: No delimiters or safety instructions are used to isolate the analyzed code from the agent's instructional context.
Capability inventory: The skill possesses the ability to read and write files and execute shell commands, creating a significant impact surface for instructions embedded in analyzed data.
Sanitization: There is no evidence of filtering or sanitizing instructions that may be hidden in code comments or strings within analyzed files.
[DATA_EXFILTRATION]: The modules/insight-generation.md module is designed to automatically post findings and code snippets to GitHub Discussions, creating a clear vector for the exfiltration of internal source code to an external service.
[METADATA_POISONING]: The modules/insight-generation.md module contains a hardcoded absolute file path (/home/alext/claude-night-market), exposing environmental information and indicating unvetted configuration.
[PROMPT_INJECTION]: The skill contains instructions that allow the agent to override safety guards, specifically the ignore scope guard directive which instructs the agent to bypass branch-size limits and continue execution into restricted zones.

code-refinement