The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides templates for constructing shell commands, such as claude -p --output-format json ... "<prompt>". This pattern is highly susceptible to command injection if the <prompt> variable contains unsanitized input from a user or external file. An attacker could use shell metacharacters (e.g., ;, `, $(...)) within the prompt to execute arbitrary code on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large amounts of project context to facilitate task delegation. This creates a surface for indirect prompt injection, as malicious instructions embedded in the source code, PR descriptions, or documentation being processed could influence the behavior of the sub-agent. This is particularly risky when combined with the write-access permissions suggested in the skill.
[PRIVILEGE_ESCALATION]: The documentation (references/invocation.md) suggests the use of the --dangerously-skip-permissions flag to bypass tool-use authorization. While a sandbox disclaimer is provided, providing instructions for disabling security guardrails increases the risk of unauthorized system modifications if the skill is used in a non-sandboxed environment.

use-claude