The Agent Skills Directory

[COMMAND_EXECUTION]: The skill sources an external shell script in SKILL.md using the SHIP_PLUGIN_ROOT environment variable (source "${SHIP_PLUGIN_ROOT}/scripts/preflight.sh"), which could lead to unauthorized code execution if the environment is compromised.
[COMMAND_EXECUTION]: There is a shell command injection vulnerability in SKILL.md Phase 1 where the <description> placeholder is directly interpolated into a bash command: TASK_ID=$(bash ".../task-id.sh" "<description>"). A malicious task description containing shell metacharacters could execute arbitrary commands.
[COMMAND_EXECUTION]: The skill instructions in execution-drill.md and independent-investigator.md specify the use of the --permission-mode bypassPermissions flag with the claude CLI. This flag disables platform-level security checks and user prompts for sub-agents, effectively bypassing security controls.
[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by interpolating user-controlled descriptions and codebase content into prompts for sub-agents without sanitization or boundary markers.
Ingestion points: Task descriptions in SKILL.md and codebase contents in independent-investigator.md and execution-drill.md.
Boundary markers: Not present in the prompt templates.
Capability inventory: Access to Bash, Write, Edit, and Agent tools across all phases.
Sanitization: No evidence of input validation, escaping, or filtering of the interpolated content.

design