The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands defined in plan markdown files across multiple phases, including preflight validation ('scripts/plan-preflight.ts') and the core workflow ('workflow.js'). While the skill implements mitigations such as a regex-based denylist for dangerous operations and shell operator filtering in test fields, the architecture inherently allows the execution of arbitrary logic provided in the input plan data.- [INDIRECT_PROMPT_INJECTION]: The skill ingests markdown plan files which may originate from untrusted repositories. These plans contain the core instructions for implementation and verification agents. Maliciously crafted plans could attempt to influence sub-agent behavior despite the use of 'AUTHORITY' block constraints in prompts.- [DYNAMIC_EXECUTION]: Runtime code execution is utilized via Python's 'SourceFileLoader' to load internal modules ('scripts/human-review-gate.sh') and through the generation of ephemeral TypeScript scripts used for linting test suites ('scripts/craft-dispatch.sh').- [PERSISTENCE]: The skill implements an autonomous heartbeat mechanism using injected '/loop' commands ('scripts/goal-self-send.sh'). This allows the agent to continue executing turns and managing the workflow loop independently until a terminal goal condition is met, representing a persistent execution state within the session.- [DATA_EXFILTRATION]: The skill accesses local conversation history files in '$HOME/.claude/projects' to verify whether injected slash commands were correctly parsed and executed by the platform ('scripts/goal-send-drain.sh'). While this is used for internal state verification, reading session logs is a sensitive capability that exposes previous conversation content.

craft