The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes external command-line interfaces (CLIs) such as codex exec and gemini via the host's bash tool. These commands are dynamically constructed by interpolating a "spec_prompt" or "engine_prompt" directly into shell strings (e.g., codex exec --full-auto "{spec_prompt}" and gemini -p "{spec_prompt}" --yolo). This pattern is vulnerable to command injection if the specification input contains shell-sensitive characters or malicious escape sequences, potentially allowing unauthorized system access outside the engine's intended scope.
[DYNAMIC_EXECUTION]: The skill implements a core loop of generating code via AI engines and then executing it through build and test commands (e.g., npm run build, npm test). This constitutes high-risk dynamic execution of generated scripts. While the skill includes instructions for scope validation using base commit diffs, an autonomous agent could still execute malicious code during the verification phase if the generated output contains harmful logic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted task specifications and decompose them into actionable prompts for secondary AI engines. This creates a large attack surface for indirect prompt injection, where a malicious specification could influence the subagents or engines to write harmful code or attempt to bypass security constraints. The lack of explicit sanitization or escaping of the user-provided specification before shell interpolation increases this risk.
[DYNAMIC_EXECUTION]: The 'CALIBRATE' workflow in references/execution-learning.md enables the skill to modify its internal logic and engine selection matrix based on runtime session outcomes. While protected by some 'Safety Guardrails', these self-modifying heuristics could be manipulated to bias the agent toward specific engines or unsafe execution configurations.

arena