The Agent Skills Directory

[COMMAND_EXECUTION]: In Step 7, the skill instructs the agent to execute a Python script via python3 -c. The script is assembled by interpolating session IDs and project paths directly into the code block string. If these variables (derived from user arguments or previously stored metrics) contain malicious payloads, it could lead to arbitrary Python code execution on the host system.
[PRIVILEGE_ESCALATION]: The skill spawns multiple subagents using the mode="bypassPermissions" configuration in Step 3. This flag explicitly bypasses the platform's standard permission prompts for tool execution. While intended for automation, this significantly increases the impact of any prompt injection attack by allowing the subagent to perform file operations or other tool calls without user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process full session transcripts via the ccrider MCP. These transcripts are untrusted external data that may contain malicious instructions designed to hijack the analysis subagents.
Ingestion points: mcp__ccrider__get_session_messages (Step 3).
Boundary markers: None specified in the subagent prompts to separate transcript content from instructions.
Capability inventory: Subagents have the ability to write files to the project directory and the main agent can execute Python code to update project metrics.
Sanitization: No evidence of sanitization or escaping is present before transcripts are passed to analysis subagents.
[DYNAMIC_EXECUTION]: The skill heavily relies on runtime generation of executable content, including dynamically constructed subagent prompts and the aforementioned Python script used to update the session ledger. This pattern of mixing control instructions with dynamic data increases the attack surface for injection and unexpected execution behavior.

session-deep-dive