The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documented internal logic (as seen in audit logs) executes the dembrandt package from the npm registry using npx -y dembrandt@latest. Executing unversioned and unverified code at runtime from a public registry is a significant security risk that can lead to arbitrary code execution if the package or its transitive dependencies are compromised.
[COMMAND_EXECUTION]: The skill executes various shell commands (e.g., omd harness, npx, git) using user-provided strings for tasks and URLs. This pattern is highly susceptible to command injection if the inputs are not rigorously sanitized, potentially allowing an attacker to execute arbitrary commands on the host system.
[DYNAMIC_EXECUTION]: The skill dynamically modifies its execution environment by overwriting subagent instruction files in the .claude/agents/ directory during "Lab Runs." Overwriting agent definitions at runtime allows the skill to alter the behavior and safety constraints of the AI agent dynamically, posing a risk of privilege escalation or safety bypass.
[PROMPT_INJECTION]: Documentation within the skill (e.g., i1-findings.md) admits to critical issues where LLM control tokens like </content></invoke> were leaked into written files. This structural leakage indicates a failure to properly sanitize data from instructions, which could be exploited for prompt injection or to manipulate the agent's control flow.

omd-lab-02-design-harness