The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/consult-claude.ts script executes the git and claude CLI tools to retrieve repository information and perform consultations. These commands are executed using structured argument arrays, and critical inputs like the session ID are validated with strict regular expressions to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied "briefs" through the claude CLI, which is a surface for indirect prompt injection. The skill implements a strong defense-in-depth model:
Ingestion points: Untrusted briefs are read from stdin in scripts/consult-claude.ts.
Boundary markers: The subprocess is invoked with --restricted, --tools Read,Glob,Grep, --permission-mode dontAsk, and --settings that block reads outside the working directory. The launcher also enforces that no hooks are triggered and no child agents are launched.
Capability inventory: The launcher is limited to repository root detection (git) and restricted CLI execution; the consultant process itself is denied write, execution, and shell capabilities.
Sanitization: The launcher enforces a strict UUID format for session resumes to prevent argument manipulation and appends a system prompt that explicitly defines the restricted, read-only role of the consultant.
[DYNAMIC_EXECUTION]: The test suite (scripts/consult-claude.test.ts) generates a mock claude executable at runtime to verify launcher behavior. This involves writing a temporary script to the filesystem and executing it. This is a standard testing practice for CLI wrappers and does not affect the security of the production skill scripts.

consult-claude