The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts using dynamic paths and arguments derived from the project state.
Evidence: Stage 0 defines CLASSIFY="<this skill's base directory>/../../scripts/classify-change.py" and executes it using python3 "$CLASSIFY" with arguments like --diff, --explain, and --files "src/**/*.swift". The cost-ledger component also executes python3 "$LEDGER" with dynamic arguments and JSON payloads via stdin.
Risk: The use of relative paths (../../scripts/) and project-derived arguments (like filenames from src/**/*.swift) introduces a command injection surface if the environment or project structure is manipulated by an attacker.
[PROMPT_INJECTION]: The instructions contain explicit directives to bypass standard user confirmation and override agent autonomy to ensure the execution of the multi-model chain.
Evidence: "Stages 2–4 run automatically. Do NOT stop after the self-pitfall rounds to ask the user whether to run Codex or the third lens — run them." and "Never go below it [the tier floor]."
Risk: These instructions override standard safety protocols that usually require user review before invoking external network-based tools or expensive operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted artifacts (PRDs, specs, plans, and code) which are then used to influence command execution and external tool routing.
Ingestion points: Files under review (SKILL.md identifies targets via diffs or file patterns).
Boundary markers: None identified; the skill directly processes the content of the artifacts.
Capability inventory: Execution of local Python scripts (python3), file system operations (git log), and external tool calls (/codex review, /third-lens-review).
Sanitization: None identified; the skill relies on the LLM's reasoning to handle the content without explicit escaping or sanitization of shell arguments.
[DATA_EXFILTRATION]: The skill facilitates the transmission of project artifacts to external review services, including infrastructure described as "non-Western."
Evidence: Stage 3 (/superpowers-gstack:third-lens-review) sends artifacts to a third-party model house. The skill body acknowledges the risk by advising: "keep sensitive artifacts — auth/keys/health/finance — to the self + Codex lenses."
Risk: While the purpose is legitimate review, the automatic execution and external routing of project data to non-standard infrastructure represent a data exposure risk if the user is not aware of which files are being transmitted.

pitfall-verification