The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands provided in external markdown files for 'gate-based' checks, with the explicit instruction to 'Run it; do not judge it by eye.'
[PROMPT_INJECTION]: The skill contains multiple instructions to bypass safety protocols and human oversight, such as 'never ask for input, pause for approval, or wait for a human' and 'Decide, do not ask.' These directives override standard agent safety practices meant to prevent unauthorized or dangerous actions.
[REMOTE_CODE_EXECUTION]: By combining the ability to read external files with the instruction to execute commands found within them autonomously, the skill creates a significant vector for remote code execution. If the directory containing the prompt files is tampered with (e.g., in a collaborative environment or via a malicious PR), the agent will execute the attacker's commands.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted data from the file system.
Ingestion points: Files in the LOOP_DIR directory and the TARGET source code.
Boundary markers: None. The skill does not use delimiters or instructions to distinguish between its own logic and instructions found within the input files.
Capability inventory: The skill has the capability to read and write files and execute shell commands autonomously.
Sanitization: There is no evidence of validation or sanitization for the commands or instructions retrieved from external sources.

review-loop