The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates a coding loop that runs the Claude CLI with the --dangerously-skip-permissions flag, allowing the agent to execute shell commands and modify files without human confirmation. The skill mitigates this high-risk behavior by offering a Docker-based isolation mode and providing explicit safety rules within the agent's prompts to prevent dangerous operations like system-level deletions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the specs/ directory into the agent's context without sanitization or strict boundary markers. This ingestion, combined with the agent's high-privilege command execution capabilities, creates a vulnerability where malicious instructions embedded in specifications could be executed by the autonomous loop.
[CREDENTIALS_UNSAFE]: The skill handles sensitive authentication tokens stored in ~/.claude-oauth-token to support headless operation. Although it includes best-practice security checks to verify that the token file has restrictive permissions (chmod 600), the access to this sensitive credential path constitutes a data exposure risk typical for autonomous setup tools.

setup-ralph