The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes an iteration loop where a sub-agent in the PREPARE phase generates Bash commands derived from human-readable rules. These commands are subsequently executed in the EVALUATE phase using the Task and Bash tools. This creates a runtime path for generating and executing shell commands based on inputs that may be untrusted, such as the task prompt or rules from project-level files.
[PROMPT_INJECTION]: Step 0 of SKILL.md establishes a mandatory instruction override mechanism by reading from .ai-factory/skill-context/aif-loop/SKILL.md. The skill explicitly instructs the agent that rules in this external file 'win' even if they 'contradict this skill's defaults,' which represents a high-risk pattern that allows external content to bypass established security or logic boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of multiple project-level files to drive generation and evaluation logic.
Ingestion points: The skill reads .ai-factory/config.yaml, project description files, architecture documentation, and RULES.md from the local environment.
Boundary markers: There are no defined delimiters or instructions provided to the agent to distinguish between safe data and potentially malicious instructions embedded in these files.
Capability inventory: The skill has access to powerful tools including Bash (shell execution), Write (filesystem modification), and Task (parallel sub-agent execution).
Sanitization: The skill performs no evident validation or sanitization of the contents of these ingested files before they are used to influence the agent's behavior.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run executable checks. While functionally necessary for a validation loop, the reliance on shell execution for dynamically generated check scripts increases the potential impact of other injection vectors.

aif-loop