The Agent Skills Directory

[COMMAND_EXECUTION]: The Bash implementations for "wait_for" and "retry_with_backoff" in "references/cbw-implementation-patterns.md" use the "eval" command on the "$condition" and "$command" arguments. This pattern is vulnerable to command injection if the input strings are derived from untrusted sources.
[DYNAMIC_EXECUTION]: The Python "check_command" function in "references/cbw-implementation-patterns.md" utilizes "subprocess.run()" with "shell=True". This allows arbitrary shell command execution and poses a risk of injection if the "command" argument is not properly sanitized.
[DATA_EXPOSURE]: The "Retro" mode in "SKILL.md" executes a script located at "~/.claude/scripts/learning-db.py". Accessing and executing scripts from hidden user directories can be a security risk as it may involve sensitive configuration or telemetry data.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data and using it to influence agent actions.
Ingestion points: In "SKILL.md", the "Handoff" mode reads repository instructions and PR comments ("gh pr view --comments"). The "Subagent" mode reads implementation plans and ADRs.
Boundary markers: The instructions do not define clear delimiters or warnings to ignore instructions embedded within the PR comments or ADR text.
Capability inventory: The skill has access to powerful tools including "Bash" (executing arbitrary commands), "Write"/"Edit" (modifying files), and "Agent" (dispatching subagents with potentially poisoned prompts).
Sanitization: There are no mentioned sanitization or validation steps for the content retrieved from external PRs or documentation before it is passed to the implementer or reviewer subagents.

process