The Agent Skills Directory

[COMMAND_EXECUTION]: The agent is instructed to find and execute verification commands from several untrusted sources, including markdown design documents ({slug}-design.md), README files, and review reports. This allows an attacker who can modify these documents to execute arbitrary shell commands with the agent's privileges.
[REMOTE_CODE_EXECUTION]: The skill's workflow involves executing scripts from Makefile and package.json, as well as running browser and API tests based on instructions parsed from local project files. This pattern of execution based on data retrieved from the environment effectively facilitates remote code execution if those files are compromised.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests data from a variety of sources (design docs, checklists, and review notes) and uses this content to build a "Verification Matrix" that dictates agent behavior. The absence of sanitization or explicit boundary markers allows instructions embedded within these files to potentially override the agent's safety constraints or intended goals.
[DATA_EXFILTRATION]: The skill has the capability to perform network operations (browser/API testing) while simultaneously accessing sensitive workspace data such as git status and git diff. This combination provides a technical path for exfiltrating source code or sensitive information that might be present in uncommitted changes.
[PROMPT_INJECTION]: Mandatory evidence chain for indirect injection:
- Ingestion points: .codestable/attention.md, {slug}-design.md, {slug}-checklist.yaml, {slug}-review.md, and README.
- Boundary markers: Not implemented; the agent is instructed to read and follow the contents of these files directly.
- Capability inventory: Execution of shell commands (CLI), browser automation, API calls, and reading of local filesystem/git history.
- Sanitization: None; the agent relies on the perceived status of files (e.g., status=passed) rather than content validation.

cs-feat-qa