The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a workflow where shell commands are dynamically generated by an LLM during the PREPARE phase and then executed via the Bash tool during the EVALUATE phase. This pattern allows the execution of arbitrary shell commands derived from potentially untrusted user prompts.
Evidence: SKILL.md and PHASE-CONTRACTS.md specify that the PREPARE phase materializes 'rule.check' instructions into 'executable' commands that are run via Bash in the EVALUATE phase.
[REMOTE_CODE_EXECUTION]: The ability to generate and execute arbitrary Bash commands based on a 'task prompt' provides a direct path for remote code execution. A crafted prompt could instruct the agent to download and run malicious scripts.
Evidence: SKILL.md allows the use of Bash and Task tools to run 'executable' checks defined at runtime by the PREPARE sub-agent based on the user's task.
[DATA_EXFILTRATION]: The skill is designed to read sensitive project files, including architecture and description documents, and possesses the capability to execute network-enabled commands via Bash. This creates a risk surface for exfiltrating internal project data.
Evidence: Step 0 in SKILL.md mandates reading the architecture and description paths, while the EVALUATE phase permits executing Bash commands that could include tools like curl or wget.
[PROMPT_INJECTION]: The skill introduces a 'skill-context' override mechanism that forces the agent to prioritize instructions found in .ai-factory/skill-context/aif-loop/SKILL.md over its own core safety or logic instructions. If this context file is compromised or contains malicious rules, it can redirect the agent's behavior.
Evidence: SKILL.md states 'the skill-context rule wins' and 'Do NOT ignore skill-context rules even if they seem to contradict this skill's defaults'.
[DATA_EXFILTRATION]: (Indirect Prompt Injection Surface) The skill processes untrusted data and possesses high-privilege capabilities.
Ingestion points: Task prompt from $ARGUMENTS, project architecture files, and .ai-factory/skill-context/aif-loop/SKILL.md.
Boundary markers: None identified; the skill directly interpolates prompt data into sub-agent instructions.
Capability inventory: Bash (execution), Write (file system), Task (sub-agents), and Read (file system).
Sanitization: No sanitization or validation of the generated shell commands is specified before execution.

aif-loop