The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to pass implementation details and architectural plans to external tools using shell piping (e.g., echo "..." | codex exec). This pattern is vulnerable to arbitrary command execution if the content contains shell-sensitive characters such as backticks, semicolons, or subshell expansions ($()).- [COMMAND_EXECUTION]: The workflow utilizes the cursor-agent command with the --force flag during implementation. This grants the agent the ability to modify or overwrite files without explicit user confirmation, increasing the potential impact of malicious instructions.- [PROMPT_INJECTION]: The skill implements a workflow that ingests untrusted data (external code and plans) in Phases 2 and 5 without sanitization or protective boundary markers. This exposes the agent to indirect prompt injection, where malicious instructions embedded in the code being reviewed could hijack the agent's logic for subsequent implementation steps performed by the cursor-agent tool. Evidence Chain: 1. Ingestion point: Phase 5 (code implementation review). 2. Boundary markers: Absent. 3. Capability inventory: cursor-agent (file writes), codex exec (command execution). 4. Sanitization: None.

codex-claude-cursor-loop