The Agent Skills Directory

[COMMAND_EXECUTION]: During the initialization phase (Phase 0), the skill executes a script located at .claude/hooks/workspace-setup.sh using bash. Since this script resides within the repository being processed, its contents are not controlled by the skill and could execute arbitrary code in the agent's environment.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates a recovery shell script at .dev-workflow/init.sh using templates and executes it. This practice of generating and running executable code at runtime increases the attack surface.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources to guide its autonomous behavior. \n
Ingestion points: The agent reads tasks.md, specs/*.md, design.md, proposal.md, and feedback signals from .dev-workflow/signals/feedback.md. It also retrieves PR comments and CI feedback via the gh and glab CLI tools.\n
Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from following malicious instructions embedded within these external documents.\n
Capability inventory: The agent has the capability to execute shell commands, perform git operations (commit, push, rebase, merge), and interact with remote repository hosts (GitHub/GitLab).\n
Sanitization: No sanitization or validation of the ingested content is described before it is used to influence the agent's task implementation or decision-making.\n- [PRIVILEGE_ESCALATION]: The skill uses chmod +x to modify permissions on the generated .dev-workflow/init.sh script, granting it execution privileges within the workspace.

aep-build