The Agent Skills Directory

[COMMAND_EXECUTION]: The file activities.py defines a Temporal activity run_verification_command that executes a command string using subprocess.run with shell=True. Using shell=True is a security risk as it enables shell metacharacter expansion and makes command injection attacks easier.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant indirect prompt injection surface. It ingests a user-provided task (via __init__.py) which is then passed directly into the PRD generation prompt in workflow.py and prompts/prd.system.md. The AI is instructed to generate a verification_command based on this task. A malicious user could provide a task description designed to trick the AI into generating harmful shell commands (e.g., "verify by running rm -rf /").
[INDIRECT_PROMPT_INJECTION]: Mandatory Evidence Chain:
Ingestion points: The task string is ingested from CLI arguments in __init__.py and passed to the workflow.
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are present in the prompts used to generate the commands (prompts/prd.system.md, prompts/prd.user.md).
Capability inventory: The skill package contains the run_verification_command activity in activities.py, which utilizes subprocess.run(shell=True). The workflow.py also has the capability to spawn_subagent and write_artifact.
Sanitization: There is no evidence of sanitization, validation, or escaping of the user-provided task or the AI-generated commands before they are processed or executed.
[COMMAND_EXECUTION]: While the prompt in prompts/verifier.system.md and others mention that verification is "simulated in v0.2", the presence of a fully implemented shell execution activity in activities.py aligned with the skill's stated purpose of "running verification" indicates a high risk of future activation or exploitation.

loop-until-done