The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in reference.md suggest using curl -fsSL https://raw.githubusercontent.com/tjarvstrand/dojjo/main/install.sh | sh. This is a critical security risk as it executes a remote script from an unverified third-party source directly in the shell without any integrity checks or version pinning.\n- [COMMAND_EXECUTION]: The dojjo tool supports a hook system (e.g., post-start, pre-merge) that executes arbitrary shell commands. These hooks are defined in TOML configuration files, including repo-local ones like dojjo.toml. This allows for the execution of arbitrary code whenever the agent or user interacts with a workspace in a repository containing a malicious configuration.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and use of software from an unverified GitHub account (tjarvstrand). Relying on third-party binaries from unknown individual accounts increases the risk of supply chain attacks.\n- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted repository data to drive behavior.\n
Ingestion points: The tool reads configuration from repository-local files: .config/wt.toml, dojjo.toml, and dojjo.local.toml.\n
Boundary markers: None identified; the tool directly parses the TOML and executes commands in the defined hook fields.\n
Capability inventory: The tool has the capability to execute arbitrary shell commands via its hook system and perform file system operations like copy-ignored (which can access sensitive files like .env).\n
Sanitization: There is no mention of sanitization or validation of the commands defined within the configuration files before they are passed to the shell.

jj-workspaces