The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically resolves the benchmark command at runtime from a project-specific configuration file named .claude/profile.yaml. Loading and executing shell commands based on content from a local file that may be subject to external influence (e.g., via pull requests) represents a significant attack surface.
[COMMAND_EXECUTION]: Through the Bash tool, the skill executes benchmark commands sourced from project configuration. This allows for arbitrary shell command execution within the agent's environment, which is highly sensitive if the command source is not strictly controlled or validated.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted external data and configuration files while maintaining high-privilege capabilities.
Ingestion points: The agent reads instructions and data from the .claude/profile.yaml configuration file and ingests the standard output and error streams from various external benchmarking tools such as k6, Lighthouse, and wrk.
Boundary markers: Although the skill mentions inheriting guardrails from a parent loop-controller skill, there are no explicit descriptions of boundary markers or specific instructions for the agent to ignore potentially malicious embedded content within the benchmark results or configuration data.
Capability inventory: The skill possesses extensive capabilities, including executing arbitrary shell commands via Bash and performing file system modifications using Read, Write, and Edit tools.
Sanitization: There is no evidence of sanitization, filtering, or strict schema validation performed on the benchmark commands or the data output by measurement tools before it is processed by the agent.

perf-loop