The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bash command in Phase 5 (counselors run) which incorporates user-controlled arguments (--models). While input validation is present using a specific regex ([a-zA-Z0-9._-]+), this remains a critical execution point where user input influences shell execution.
[CREDENTIALS_UNSAFE]: Phase 5 automatically sources sensitive environment variable files from multiple locations, including ~/.env, .env, and ~/.vibe-tools/.env. This exposes all secrets stored in those files to the process environment of the counselors command.
[INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans which are considered untrusted external data.
Ingestion points: The skill reads plan content from files or directories provided via arguments or detected via git logs and diffs.
Boundary markers: The skill implements boundary markers in Phase 4, wrapping untrusted content in <plan-content> tags and providing explicit instructions to the LLM to treat the content as data and ignore any embedded directives.
Capability inventory: The skill has filesystem write access (creating logs and stack profiles), bash execution capabilities (git commands and the counselors CLI), and network access (MCP tools and WebFetch).
Sanitization: It validates plan paths for directory traversal (rejecting ..) and restricts model names to a safe character set using regular expressions.
[EXTERNAL_DOWNLOADS]: Phase 3 uses WebFetch to download llms.txt files from library websites as a fallback for documentation. If a plan references a library with a malicious website URL, the agent will attempt to fetch content from that external domain.
[DYNAMIC_EXECUTION]: The skill generates and executes a shell script sequence in Phase 5 to source environment variables and run the counselors CLI tool. This dynamic assembly of shell commands is a vector for execution concerns, though mitigated by argument validation.

critic-review