The Agent Skills Directory

[COMMAND_EXECUTION]: The templates/loop.sh script automates the execution of an AI agent using the claude CLI. This allows the model to execute arbitrary shell commands within the project environment during its autonomous 'build' phase.
[PRIVILEGE_ESCALATION]: The templates/loop.sh script invokes the agent using the --dangerously-skip-permissions flag. This intentionally disables security mechanisms designed to require human approval for tool execution, granting the autonomous loop full execution privileges on the local system without oversight.
[DATA_EXFILTRATION]: The system is configured to automatically perform git push operations within templates/loop.sh and is explicitly instructed to do so in templates/PROMPT_build.md. This creates a path for the exposure of sensitive information, credentials, or malicious code modifications to remote repositories.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection because it processes untrusted project data while possessing high-privilege capabilities.
Ingestion points: The agent studies and processes project specifications (specs/*), source code (src/*), and implementation plans (IMPLEMENTATION_PLAN.md).
Boundary markers: The instructions lack boundary markers or specific guidance to ignore instructions that might be embedded within the data files being analyzed.
Capability inventory: The agent has full shell execution capabilities (with bypassed permissions) and the ability to commit and push to remote repositories.
Sanitization: No sanitization or validation of the ingested file content is performed, allowing potentially malicious instructions in code comments or specifications to be treated as valid agent directives.

ralph-iteration