The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's configuration template for agents (e.g., ClaudeCodeAgent) includes the dangerouslySkipPermissions: true flag. This setting bypasses the standard security mechanism that requires user approval for shell commands and file system modifications, allowing the agent to execute arbitrary code autonomously on the host system.
[PROMPT_INJECTION]: The skill is designed to ingest and process content from external repository files and specification documents via properties like specsPath and focusDirs. This creates a large attack surface for indirect prompt injection. Since the agent is configured to skip permissions, any malicious instruction embedded in the codebase or docs could be executed without the user's knowledge.
Ingestion points: specsPath (e.g., docs/), referenceFiles, and directory-scoped codebase reviews (focusDirs).
Boundary markers: The skill relies on natural language headers in prompts (e.g., ## Already implemented) but lacks technical delimiters or "ignore" instructions for the ingested content.
Capability inventory: The agents are granted permissions to run shell commands (buildCmds, testCmds), modify files (implied by the implementation role), and operate without interactive confirmation.
Sanitization: No evidence of input validation, escaping, or filtering of the content read from the repository.
[DATA_EXFILTRATION]: The combination of autonomous file system access and the inherent network capabilities of LLM agents allows for potential data exfiltration. An agent compromised via indirect injection could read sensitive files (like the SQLite state database or .env files) and transmit them externally.

super-ralph