The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute local shell scripts for repository analysis and configuration. While these scripts (check-existing.sh, detect-branch.sh, detect-tech-stack.sh, detect-versions.sh, gitignore-add.sh, verify-setup.sh) appear to perform standard project analysis tasks like checking for file existence, detecting language versions, and managing .gitignore entries, they run directly on the host system.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax in SKILL.md to execute scripts at load time (e.g., !"${CLAUDE_PLUGIN_ROOT}/skills/init/scripts/check-existing.sh"). This pattern allows for silent command execution whenever the skill is accessed or loaded by the agent.
[DYNAMIC_EXECUTION]: The execution paths for the shell scripts are constructed using the ${CLAUDE_PLUGIN_ROOT} environment variable (e.g., !"${CLAUDE_PLUGIN_ROOT}/skills/init/scripts/detect-branch.sh"). This introduces a risk where, if the environment variable is manipulated or points to a writable directory, the agent could be tricked into executing malicious scripts instead of the intended ones.

init