The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in Phase 1 explicitly direct the agent to execute a local script file named scripts/task-status.ts if it exists in the project workspace. This represents a command execution vulnerability where a malicious repository could include a script with the same name to execute arbitrary code on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill collects data from various local project files, including tasks/, specs/, and DEPENDENCIES.md, to generate "starting prompts" for future tasks.
Ingestion points: Reads files from tasks/, specs/, and DEPENDENCIES.md (SKILL.md).
Boundary markers: The output uses XML tags defined in templates/prompt.xml, but there are no instructions or logic to sanitize or escape the content ingested from the files.
Capability inventory: The skill uses the Bash tool and has the capability to write files to the ~/.claude/ directory.
Sanitization: There is no evidence of sanitization or validation of the ingested file content before it is placed into the XML blocks. A malicious file could include closing tags (e.g., </task>) to inject instructions that an agent might follow in a subsequent worktree session.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform Git operations and manage the filesystem (e.g., mkdir -p). While these are necessary for the skill's stated purpose, they provide a broad capability surface that is used to execute repository-controlled scripts.

split-work