The Agent Skills Directory

[COMMAND_EXECUTION]: The setup.sh script generates a configuration file (.claude/settings.json) that grants the agent permission to execute shell commands via the Bash tool without requiring user confirmation.
Evidence: scripts/setup.sh (lines 136-170) adds "Bash" to the allow array in the generated settings.
[REMOTE_CODE_EXECUTION]: The generated configuration pre-approves the mcp__tidewave__project_eval tool, which allows the agent to execute arbitrary Ruby code within the running Rails application context without prompting the user for approval.
Evidence: scripts/setup.sh (lines 136-170) adds "mcp__tidewave__project_eval" to the allow array in the generated settings.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs third-party Ruby gems from the public RubyGems registry during the setup process.
Evidence: scripts/setup.sh executes bundle add tidewave (Line 118) and gem install hotwire_club-mcp (Line 123).
[PROMPT_INJECTION]: The skill establishes an environment with a significant indirect prompt injection surface by combining auto-approved execution capabilities with web-access tools. An attacker could potentially use malicious content on an external website or within project documentation to trigger the agent's pre-approved shell or Ruby execution tools.
Ingestion points: The agent is configured to use WebFetch and WebSearch and interacts with project files.
Boundary markers: No delimiters or ignore-instructions are configured in the generated environment.
Capability inventory: The agent has auto-approved Bash, Edit, Write, and project_eval permissions.
Sanitization: There is no evidence of input validation or sanitization for data processed by these tools.

rails-8-setup