The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary logic in scripts/run-loop.mjs and references/adapters.js uses child_process methods (spawn, spawnSync, execFileSync) to run agent engines (claude, agy), probe scripts (node), and development tools (git). This is the intended functionality to facilitate unattended sequential loops, but it represents a powerful capability to execute local commands and scripts.
[INDIRECT_PROMPT_INJECTION]: The supervisor is susceptible to indirect prompt injection because its core decision-making logic (classification of loop outcomes) is based on the state of the filesystem, which is modified by the agent being supervised.
Ingestion points: scripts/run-loop.mjs and references/classify.js ingest data from state files and locks, specifically .claude/state/develop-pipeline.lock, .claude/state/develop-next.state.json, and .claude/state/develop-pipeline.last-halt.json.
Boundary markers: Absent; the classifier relies on JSON structure but does not include explicit instructions to the model to ignore embedded data within these files.
Capability inventory: The skill possesses extensive subprocess execution capabilities, including spawning shell commands and agent processes.
Sanitization: Sanitization is limited to JSON schema validation and timestamp verification; a compromised agent could potentially write malicious or deceptive content into these state files to manipulate the supervisor's control flow (e.g., forcing a halt or a retry).
[DATA_EXFILTRATION]: The skill can be configured to report run metadata to external endpoints via the --dashboard and --webhook flags. While the skill actively redacts credentials from environment variables (LOOP_SUPERVISOR_DASHBOARD_TOKEN) and Git remote URLs before transmission, these network operations allow project-specific metadata (such as branch names, PR URLs, and iteration summaries) to be sent to third-party services.
[DYNAMIC_EXECUTION]: In references/adapters.js, the skill uses require.resolve and spawns a fresh Node.js process to dynamically locate and validate probe scripts before they are executed. This mechanism allows the skill to flexibly load adapter logic based on configuration or project layout while ensuring the script is available and executable.

loop-supervisor