The Agent Skills Directory

[PERSISTENCE]: The skill installs scripts/stop-hook.sh as a Stop hook in the agent's configuration (~/.claude/settings.json). This script checks for an active session file and returns a block decision to the platform if the loop is not yet complete, forcing the agent to continue execution across turns.
[PRIVILEGE_ESCALATION]: The skill modifies the agent's primary configuration file (~/.claude/settings.json) and uses the claude mcp add command to register new MCP servers. Furthermore, worker subagents are dispatched via the Agent tool using the bypassPermissions flag, which allows them to modify files without individual user approval steps for each edit.
[COMMAND_EXECUTION]: The skill performs several automated system operations, including configuring MCP servers, executing the codex CLI for external reviews, and running bash scripts (eval.sh, stop-hook.sh) that use grep, sed, awk, and jq to parse and manipulate session state files.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from multiple sources: the artifact_path containing project plans and source code, summaries from worker subagents, and natural language review responses from Codex. While the guide.md specifies a 'Trust Boundary' where the orchestrator must map reviewer output to a structured ledger rather than executing it directly, the ingestion of these external artifacts into subagent prompts creates an attack surface for indirect instructions. Mandatory Evidence Chain: 1. Ingestion: plan artifacts, worker summaries, and Codex review responses. 2. Boundary markers: guide.md explicitly warns about adversarial content in repository artifacts and treats Codex output as advisory. 3. Capability inventory: file system modifications (subagents), command execution (codex), and agent configuration modification. 4. Sanitization: the orchestrator maps natural language reviewer feedback into a structured finding ledger.

ralph-lisa-loop