The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates the execution of a local shell script at ${CLAUDE_PLUGIN_ROOT:-$HOME/.claude-octopus/plugin}/scripts/orchestrate.sh. It instructs the agent to pass <user arguments> directly to this script, which creates a risk of command injection if arguments are not properly handled.
[DYNAMIC_EXECUTION]: The skill constructs shell commands by concatenating fixed paths with variable user input and environment variables. The instructions explicitly describe how to structure these commands to ensure they are executed unsandboxed by matching specific prefix requirements of the platform's security allowlist.
[PRIVILEGE_ESCALATION]: The instructions include specific guidance on how to bypass default sandbox restrictions. By ensuring the script path is the first token of the command and avoiding common shell patterns like cd, the skill attempts to exploit the platform's prefix-based allowlist matching to gain unsandboxed execution status.
[INDIRECT_PROMPT_INJECTION]: The council workflow involves gathering evidence from external research and a local project corpus. 1. Ingestion points: Research data is gathered from external sources and the project corpus. 2. Boundary markers: No delimiters or instructions are provided to ignore potential instructions in the data. 3. Capability inventory: The skill can execute shell scripts and potentially modify files. 4. Sanitization: No validation or sanitization is described.

skill-council