The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to read DEVELOPMENT.md to identify specific commands for workspace management (e.g., workspace --guide). The agent is then directed to execute these commands found in the file. Since project files are external and potentially untrusted, this creates a mechanism for arbitrary command execution.
Evidence: references/project-workspace-setup.md directs the agent to read ~/projects/{PROJECT_NAME}/DEVELOPMENT.md to find the project's guide command and instructions for listing and setting up workspaces, and explicitly tells the agent to "Use them".
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from project-level files and uses them as primary instructions for the alcode agent, which possesses high-privilege capabilities.
1. Ingestion points: The agent reads content from DEVELOPMENT.md, README.md, AGENTS.md, *spec.md, and *summary.md within the ~/projects/ directory.
1. Boundary markers: Absent. The instructions explicitly state that the playbook "tells you what to do. Do not improvise," which increases the likelihood of the agent following malicious instructions embedded in these files.
1. Capability inventory: The skill has extensive capabilities, including file system access, shell execution via the exec tool, and interaction with GitHub/GitLab through gh and glab CLI tools.
1. Sanitization: Absent. There is no evidence of validation or filtering for the content retrieved from external project files before it is processed or used to drive agent actions.

openclaw-coder-playbook