The Agent Skills Directory

[COMMAND_EXECUTION]: The vibereview command attempts to locate and execute binaries from relative paths (e.g., ../VibeReview/.build/reinstall/vibereview) and hardcoded user directories (e.g., /Users/randroid/Documents/Dev/VibeReview/build/vibereview). Executing binaries from locations outside the project root or within user directories is risky as these paths may be controlled by other processes or users.
[REMOTE_CODE_EXECUTION]: The randroid-loop.sh script executes codex exec --yolo within a self-sustaining loop. The --yolo flag bypasses user confirmation, allowing the agent to execute code it generates autonomously. This poses a significant risk if the agent's logic is influenced by malicious input or errors.
[PROMPT_INJECTION]: The address-pr-comments command is designed to ingest and act upon PR review comments. This creates an indirect prompt injection vulnerability where an external contributor could provide a malicious comment that instructs the agent to perform unauthorized file modifications, data exfiltration, or other harmful actions under the guise of feedback.
[EXTERNAL_DOWNLOADS]: The vibereview setup logic in SKILL.md and commands/vibereview.md includes a fallback to execute a build script located in a sibling directory (../VibeReview/scripts/build.sh). Executing build scripts from external directories introduces a dependency on untrusted local state and can lead to the execution of arbitrary code.
[COMMAND_EXECUTION]: The skill implements a persistence mechanism via hooks/hooks.json using a Stop hook. This hook executes stop-hook.sh whenever the session attempts to exit, allowing the skill to programmatically reject the exit and force a new iteration, effectively creating a persistent autonomous loop that is difficult for a user to interrupt without force-killing the process.

randroid