The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions designed to bypass the host platform's safety and oversight mechanisms. It mandates 'RALPH WIGGUM MODE', which forces the agent to operate autonomously without asking questions, waiting for user confirmation, or stopping. It explicitly requires the agent to 'NEVER ask questions' and 'NEVER wait for confirmation', effectively disabling the human-in-the-loop safety model of Claude Code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest arbitrary data from 'Product Requirements Documents' (PRDs) as its primary input. Because the agent possesses high-privilege capabilities—including file system modification, shell command execution via Bash, and cloud service deployment—it is highly vulnerable to indirect prompt injection. A malicious PRD could potentially hijack the autonomous workflow to exfiltrate credentials or perform unauthorized system changes.
[DYNAMIC_EXECUTION]: The orchestration script autonomy/run.sh employs several dynamic execution techniques. It creates a self-copy of its own shell script in a temporary directory (/tmp/loki-run.XXXXXXXX/run.sh) and uses exec to relaunch from that location. Additionally, it dynamically generates and executes Python code at runtime using heredocs to handle learning extraction and state management.
[COMMAND_EXECUTION]: Included within the benchmark results are Python solutions for 'HumanEval' that utilize the dangerous eval() function (e.g., in benchmarks/results/2026-01-05-00-49-17/humaneval-solutions/160.py). While these are outputs of the agent, the benchmark infrastructure is designed to execute these files during evaluation runs.
[EXTERNAL_DOWNLOADS]: The benchmark runner script benchmarks/run-benchmarks.sh downloads external datasets from GitHub and OpenAI and installs the swebench package from PyPI. While these are reputable sources, the automated nature of these downloads integrated into the skill's workflow increases the supply chain risk profile.

loki-mode