The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends installing third-party extensions from untrusted GitHub repositories (mattpocock/skills and joeseesun/qiaomu-goal-meta-skill) using the npx skills add command. This execution method allows for arbitrary code to be downloaded and integrated into the agent's environment.\n- [PRIVILEGE_ESCALATION]: The skill's implementation templates (e.g., scripts/launch-runner-template.sh) and instructions suggest using the --permission-mode bypassPermissions flag for agents like claude-code. This flag explicitly disables safety filters and user-permission prompts for file system and shell operations, effectively escalating the agent's autonomous privileges.\n- [COMMAND_EXECUTION]: The skill uses a 'Control-plane kernel' consisting of multiple shell scripts (e.g., scripts/adr, scripts/detect-runtime-host.sh) to manage state, detect execution hosts, and orchestrate the implementation loop. These scripts execute various system commands and manage external agent terminals, creating a complex execution chain.\n- [INDIRECT_PROMPT_INJECTION]: The 'devloop' architecture involves multiple agents (compiler, impl runner, and reviewer) processing requirements and code. This creates a vulnerability surface for indirect prompt injection where malicious instructions embedded in a requirement or code comment could influence the behavior of downstream agents.\n
Ingestion points: Requirement data is processed into plan.md and next-goal.md (SKILL.md, references/goal-template.md).\n
Boundary markers: The skill uses structured templates but lacks robust delimiters or escaping to separate untrusted user data from agent instructions.\n
Capability inventory: The system performs file writes, subprocess execution, and handles git operations across multiple worktrees (scripts/adr, references/orca-host.md).\n
Sanitization: No explicit sanitization or filtering of external content is performed before interpolation into agent prompts.

devloop