The Agent Skills Directory

[COMMAND_EXECUTION]: The skill resolves build and test commands from project-controlled files including package.json, Makefile, pyproject.toml, and Cargo.toml. These resolved strings are then executed using the Bash tool, allowing the repository content to dictate the agent's shell activity.
[DYNAMIC_EXECUTION]: In references/gate-commands.md and references/stop-hook.md, the skill generates and executes shell scripts that use eval to run the commands extracted from project configuration. The use of eval on potentially untrusted strings is a dangerous pattern that facilitates arbitrary command injection.
[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting data from external files which may be controlled by an attacker (e.g., in a Pull Request context).
Ingestion points: Reads configuration from .claude/profile.yaml, package.json, Makefile, pyproject.toml, tox.ini, Cargo.toml, go.mod, composer.json, Taskfile.yml, and Justfile.
Capability inventory: Access to Bash, Write, Edit, Read, Grep, and Glob tools.
Boundary markers: The instructions do not specify any delimiters or safety headers to prevent the agent from following instructions embedded within these configuration files or the output of the commands they trigger.
Sanitization: There is no evidence of validation or sanitization for the command strings before they are passed to the shell.

fix-until-green