The Agent Skills Directory

[DYNAMIC_EXECUTION]: The instructions in judge-prompt.md direct the subagent to execute a shell command by interpolating a YAML array into a bash command string: echo '<yaml_array>' | bun run .... Because the array includes content taken directly from untrusted review JSON files (such as issue and code_snippet), this pattern allows for shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which can contain malicious payloads designed to manipulate the agent's logic. * Ingestion points: JSON review files are ingested from the file system using the Read tool as specified in judge-prompt.md. * Boundary markers: There are no delimiters or explicit instructions to ignore embedded commands within the ingested JSON content. * Capability inventory: The subagent is granted high-privilege tools including Bash for shell execution and Task for agent orchestration. * Sanitization: No input validation or shell-escaping is performed on the data before it is embedded in the shell command string.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local script with dynamically generated arguments. This execution model is inherently unsafe when the arguments are not strictly validated or sanitized against command injection patterns.

capture-eval-issues