The Agent Skills Directory

[COMMAND_EXECUTION]: The external review protocol defined in references/external-review.md employs unsafe shell interpolation. The implementation plan's content is expanded directly into Bash commands using the $(cat ...) pattern inside double-quoted strings. This allows shell metacharacters such as backticks or subshells present within the generated plan to be executed by the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection by aggregating data from untrusted sources into a process that ends in command execution. A malicious specification or poisoned web research results could lead the agent to include shell-executable payloads in the final plan.
Ingestion points: User-provided specification file (@file.md) and web research results obtained via subagents.
Boundary markers: None used when interpolating content into the shell environment for external reviews.
Capability inventory: The skill has capabilities for file system writes, Bash execution, and spawning subagents (Explore and general-purpose types).
Sanitization: There is no evidence of shell-escaping or content validation performed on the synthesized plan before it is passed to the shell.
[EXTERNAL_DOWNLOADS]: The documentation (README.md and references/external-review.md) recommends the installation of external CLI tools, specifically gemini-cli from Google and codex from OpenAI. These are well-known technology services, and the instructions are provided to the user for manual environment configuration.

gepetto