The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's entire workflow is driven by the content of a subtask JSON file (.tmp/tasks/{feature}/subtask_{seq}.json), which defines the implementation goals, acceptance criteria, and files to be accessed. If this file is generated based on untrusted external data (such as issue descriptions or PR comments), it could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: .tmp/tasks/{feature}/subtask_{seq}.json read in Step 1.
Boundary markers: None; the agent is instructed to follow acceptance_criteria EXACTLY.
Capability inventory: File system read access (Steps 1, 2, 3), file system write access (Step 5), and shell command execution (Steps 6, 7).
Sanitization: The skill includes a grep scan for secrets and debug logs in its deliverables, but lacks validation or sanitization for the input JSON fields that control its execution flow.
[COMMAND_EXECUTION]: In Step 7, the skill executes a local shell script (.opencode/skills/task-management/router.sh) using variables {feature}, {seq}, and {summary}. These variables are derived from the subtask file or the agent's reasoning process. If these inputs are not properly sanitized by the underlying platform, they could be exploited for command injection if they contain shell metacharacters.
[DATA_EXFILTRATION]: The reference_files and context_files arrays in the subtask configuration determine which files the agent reads during the implementation process. A malicious subtask definition could include sensitive files (such as .env, ~/.aws/credentials, or SSH configuration) in these lists to expose their contents to the agent's context.

code-execution