The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx @claude-flow/cli@latest to execute task hooks, which involves downloading and running code from the NPM registry at runtime.
[COMMAND_EXECUTION]: User-provided arguments for <context> and <aggregate-name> are interpolated directly into shell commands in steps 2 and 10 (e.g., npx ... --description "DDD aggregate: <aggregate-name> in <context>"). This creates a vulnerability to command injection if a user provides arguments containing shell metacharacters like semicolons or backticks.
[REMOTE_CODE_EXECUTION]: The use of npx with the @latest tag facilitates the execution of remote code. While the package name appears related to the framework, the execution of unpinned versions from a remote registry is a supply chain risk.

ddd-aggregate