The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute claude -p, spawning a separate instance of the Claude agent as a background process.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use the --dangerously-load-development-channels flag to load the conductor-channel MCP server. This allows the execution of external development-grade code extensions within the agent's environment.
[PROMPT_INJECTION]: The shell command explicitly unsets safety environment variables (CLAUDECODE and CLAUDE_CODE_ENTRYPOINT) to bypass the built-in recursion blocks that prevent an agent from spawning another instance of itself.
[DATA_EXFILTRATION]: The skill facilitates the transfer of repository content to a "mesh" network via the send_message tool. While intended for peer review, this establishes a network-based data flow for local file contents.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the following surface:
Ingestion points: The secondary agent reads repository files (source code, diffs) based on user or git activity.
Boundary markers: No specific delimiters or instructions are used in the reviewer template to isolate untrusted file content from the reviewer's instructions.
Capability inventory: The spawned reviewer has access to Bash, Read, Glob, and Grep, as well as mesh communication tools.
Sanitization: There is no validation or sanitization of the file content before it is processed by the secondary agent, allowing embedded instructions in code comments or documentation to potentially influence the reviewer's output.

peer-review