The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute external CLI commands for architectural review. The use of the --approval-mode yolo flag for the Gemini CLI and the --full-auto flag for the Codex CLI is a security concern, as these flags are designed to suppress human oversight and bypass standard safety confirmations during the execution of remote operations.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-stage data pipeline where a user-provided specification file is processed and eventually incorporated into a high-priority prompt file (claude-ralph-loop-prompt.md) intended for autonomous implementation by external plugins.
Ingestion points: Initial markdown spec file provided via the @file parameter at invocation (Step 2).
Boundary markers: The generated instruction files lack clear delimiters or specific instructions to ignore potentially malicious embedded content within the synthesized specification.
Capability inventory: The workflow utilizes Bash execution, Task subagents, and WebSearch capabilities.
Sanitization: No validation or sanitization mechanisms are identified to ensure that content from the user-provided spec file does not contain instructions that could hijack the automated implementation process.
[PROMPT_INJECTION]: The instruction set for external reviewers (documented in references/external-review.md) explicitly requests an 'unconstrained assessment'. This phrasing is a common indicator of attempts to bypass model safety filters or ethical guardrails.
[DATA_EXFILTRATION]: The skill reads implementation plans that may contain sensitive architectural details or codebase findings and transmits the full content to external binaries. The automated transmission of synthesized project data to external command-line interfaces increases the risk of unauthorized data exposure.

gepetto