The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates unsanitized user arguments ( and ) directly into shell commands used for lifecycle hooks and database operations in steps 2, 9, and 10. An attacker could provide arguments containing shell metacharacters (e.g., ;, &&, or backticks) to execute arbitrary commands on the system.
[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute the @claude-flow/cli package at runtime in steps 2 and 10. The use of @latest instead of a pinned version exposes the environment to supply chain attacks where a compromised package could execute malicious code.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads from the npm registry via npx to fetch the @claude-flow/cli package during the scaffolding process.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data through $ARGUMENTS and interpolating it into files and commands without boundary markers or sanitization. Ingestion points: $ARGUMENTS in SKILL.md; Boundary markers: Absent; Capability inventory: Bash, Write, Edit; Sanitization: Absent.

ddd-aggregate