The Agent Skills Directory

[COMMAND_EXECUTION]: The module modules/deferred-capture.md contains instructions for the agent to execute a Python script (scripts/deferred_capture.py) via the shell using string interpolation of untrusted content. Evidence shows the --context argument is built by placing <user rationale> directly inside a double-quoted string. This creates a critical command injection risk where shell meta-characters (such as backticks, semicolons, or dollar signs) in the user-supplied rationale could lead to arbitrary command execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: A vulnerability surface is present where user-controlled data is ingested and passed to sensitive system capabilities.
Ingestion points: User-provided 'problem statement' and 'rejection rationale' collected in Phase 1 and Phase 5 of SKILL.md.
Boundary markers: None identified; the instructions do not suggest delimiting or escaping the input before use.
Capability inventory: Shell command execution via python3 in modules/deferred-capture.md and automated file writing across multiple phases.
Sanitization: Absent; the logic assumes the input is safe to interpolate directly into shell arguments.
[DYNAMIC_EXECUTION]: The modules/spec-review-loop.md implements an automated 'Spec Review Loop' that dispatches a subagent to identify issues and then directs the main agent to 'apply fixes to the spec document' autonomously for up to three iterations. This dynamic feedback loop allows LLM-generated content to modify local files without mandatory human-in-the-loop validation for each change.

project-brainstorming