The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates the execution of multiple bash scripts located in a hidden directory (~/.claude-octopus/plugin/scripts/), including check-providers.sh, state-manager.sh, and orchestrate.sh. These scripts are used for provider checks, state persistence, and research orchestration. The skill relies on the presence of these external scripts to function, which represents a dependency on unverifiable local code.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a significant attack surface for command injection by capturing user input through AskUserQuestion in Step 1 and interpolating it directly into shell commands in Step 4 and Step 6.5.
Ingestion points: User answers for 'What to specify', 'Actors', and 'Key constraints' in Step 1.
Boundary markers: None; the instructions direct the agent to 'Incorporate the user's answers... into the probe query'.
Capability inventory: Multiple calls to the bash tool to execute orchestrate.sh and state-manager.sh (Steps 2, 3, 4, 5, 6.5, 8).
Sanitization: None; the strings are placed directly inside double-quoted bash arguments (e.g., orchestrate.sh probe "...<project description>..."), which can be escaped to execute arbitrary commands.
[PROMPT_INJECTION]: The instructions employ aggressive enforcement markers and behavioral overrides such as 'STOP
SKILL ALREADY LOADED', 'DO NOT call Skill() again', 'MANDATORY
CANNOT SKIP', and 'PROHIBITED from researching directly'. While these are used to guide the model through a specific workflow, they utilize patterns identical to those used in adversarial prompt injections to bypass or override core agent instructions.
[DYNAMIC_EXECUTION]: In Step 6.5, the skill instructs the agent to dynamically generate a command that passes the entire draft specification (containing user-controlled content) into the orchestrate.sh spawn command. This represents runtime assembly and execution of content that may contain untrusted data.

flow-spec