The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions for Step 7 describe a sanitization procedure that uses a shell here-string to pass subagent-controlled data ($raw_summary) into a Python command. This pattern is vulnerable to shell command injection if the subagent output contains expansion sequences like backticks or the $(...) syntax, allowing the data to escape the literal context and execute arbitrary code.
[REMOTE_CODE_EXECUTION]: Due to the shell interpolation vulnerability in the sanitization step, a malicious subagent or a specifically crafted evaluation task can achieve execution of arbitrary shell commands in the main agent's environment.
[DATA_EXFILTRATION]: While not the primary intent, the command injection surface provides a pathway for an attacker to access environment variables (such as XDG_RUNTIME_DIR), read local files, or capture sensitive process information and exfiltrate them.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by instructing subagents to read and follow directions from local files (<NNN>-reviewer.md) without explicit boundary markers or instructions to ignore nested commands. If these files are sourced from untrusted inputs, they can hijack the subagent's logic.
Ingestion points: The skill reads stage-manifest.json and instructs subagents to read <NNN>-reviewer.md from the /tmp or $XDG_RUNTIME_DIR directory.
Boundary markers: No explicit delimiters or safety instructions are provided in the subagent prompt to separate system instructions from file content.
Capability inventory: The skill utilizes shell execution (python -c), file system writes (os.replace), and structural integrity checks (os.fsync).
Sanitization: The skill attempts to sanitize subagent output using sanitize_summary, but the implementation via shell interpolation creates a secondary security risk.

temper-eval-collect