The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the shell command pattern claude -p --model opus --effort high "<prompt>". This construction is vulnerable to shell command injection if the <prompt> variable contains unbalanced double quotes, backticks, or shell metacharacters (e.g., $(...)), allowing an attacker to execute arbitrary commands on the host system.
[COMMAND_EXECUTION]: The instructions explicitly guide the agent to use high-risk flags such as --permission-mode dontAsk and --dangerously-skip-permissions. These flags are designed to bypass interactive user confirmation for sensitive tool operations like file system modification or shell script execution, significantly reducing the security boundary between the agent and the host.
[PROMPT_INJECTION]: The skill facilitates the processing of arbitrary repository files through a subagent. While it includes warnings to verify output, the design creates a surface for indirect prompt injection where malicious instructions embedded in codebase files could trick the subagent into performing unauthorized actions or returning biased results.
[DATA_EXFILTRATION]: The claude CLI is a networked tool that requires authentication. While it is a legitimate tool, the skill's instructions to use it in non-interactive modes (-p) combined with access to repository data creates a path for data exposure if the subagent is manipulated into sending sensitive file content to the LLM provider's API.

claude