The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is installed via npx agentic-jujutsu and utilizes an embedded binary (jj) hosted on a non-vendor GitHub repository (ruvnet/agentic-flow). This introduces a supply chain risk where the binary's integrity cannot be easily verified.
[COMMAND_EXECUTION]: The skill includes a jj.execute() method capable of running arbitrary shell commands. This creates a risk if the agent is directed to execute commands based on unvalidated data or malicious instructions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its 'ReasoningBank' self-learning mechanism.
Ingestion points: Data enters the system context via jj.startTrajectory(task) and jj.finalizeTrajectory(score, critique) in SKILL.md.
Boundary markers: There are no markers or instructions to delimit or ignore embedded commands within the processed task and critique fields.
Capability inventory: The skill possesses powerful capabilities including jj.execute() and dynamic loop execution of operations as shown in adaptiveDeployment.
Sanitization: The documented validation rules (v2.3.1+) only enforce size and score range constraints, failing to sanitize against embedded malicious instructions that could manipulate the AI's 'suggestions'.
[REMOTE_CODE_EXECUTION]: The adaptiveDeployment use case demonstrates an unsafe pattern where an agent executes a sequence of recommendedOperations provided by the jj.getSuggestion() tool. Because these suggestions are generated from potentially poisoned historical data (trajectories), this enables remote control over the agent's command execution loop.

agentic-jujutsu