The Agent Skills Directory

[COMMAND_EXECUTION]: The poller script scripts/watch.sh executes the claude CLI using the --dangerously-skip-permissions flag. This allows the AI agent to perform shell commands and file system modifications without user approval, which is a high-risk capability in an autonomous environment.
[PROMPT_INJECTION]: The system architecture creates an indirect prompt injection surface. The "Executor" agent follows instructions parsed from NEXT-STEPS.md. If this file is modified by an untrusted process or contains malicious instructions generated by the "Planner" agent, the "Executor" could be coerced into performing unauthorized actions.
[COMMAND_EXECUTION]: The scripts/pr-gate.sh and scripts/watch.sh scripts utilize the GitHub CLI (gh) and git to manage PRs and branch state. This requires the host environment to have active, persistent credentials (e.g., GitHub tokens), which are then accessible to the autonomous loop and its constituent scripts.
[DATA_EXFILTRATION]: The "Executor" agent is granted push access to the repository to open pull requests and update status files. This capability could be leveraged to exfiltrate sensitive code or configuration files if the agent's instructions are subverted to commit such data to a remote branch.

two-claude-relay