The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow instructions in 'SKILL.md' (Step 4: Persist Decision) direct the agent to execute a shell command ('echo') that interpolates the user-provided '{TOPIC}' and '{DECISION}' variables directly. This creates a high risk of command injection if these inputs contain shell metacharacters (e.g., semicolons, backticks, or pipe symbols).
[COMMAND_EXECUTION]: The 'hooks/post-execute.cjs' script uses 'require()' with a dynamically computed file path to load an observability script ('send-event.cjs'). Loading code from computed paths is a significant risk as it can be exploited to execute unintended scripts if the file system environment is manipulated.
[PROMPT_INJECTION]: The skill takes user-supplied input for the debate topic and stances, which are then interpolated into the prompts used by the PRO and CON agents. This creates an indirect prompt injection surface where a malicious user could provide a topic or stance containing instructions to override the agent's behavior.
Ingestion points: Debate topic, pro-stance, and con-stance arguments provided via CLI or skill invocation.
Boundary markers: The 'scripts/main.cjs' scaffolds these inputs into a JSON template, which is then processed by the agents.
Capability inventory: The skill uses the 'Bash' tool to read and write to a local project memory file.
Sanitization: Input validation in 'hooks/pre-execute.cjs' is limited to string length checks and presence validation, lacking robust escaping or sanitization for prompt or shell safety.
[DATA_EXFILTRATION]: The skill reads from and writes to a local project-specific decision log file ('C:/dev/projects/agent-studio/.claude/context/memory/decisions.md'). While intended for memory persistence, this involves accessing potentially sensitive architectural or design history data.

adversarial-debate