The Agent Skills Directory

[COMMAND_EXECUTION]: The script hooks/verify-loop.py is configured as a SubagentStop hook that automatically executes shell commands retrieved from the verify_commands field of a task.json file. It uses subprocess.run(shell=True), which allows for arbitrary command execution on the host system.
[DYNAMIC_EXECUTION]: The skill's architecture relies on dynamic execution of shell commands stored in JSON state files. These files are intended to be generated and updated by agents (code-reviewer, develop) during the workflow, creating a direct path from agent-generated text to system command execution.
[REMOTE_CODE_EXECUTION]: A significant risk of remote code execution exists because the agents responsible for writing the verify_commands ingest and analyze external codebase content and documentation. A malicious actor could use indirect prompt injection in a codebase to trick the agents into injecting malicious shell commands into the task.json file, which the host environment will then execute.
[PERSISTENCE]: The install.py script modifies the user's global ~/.claude/settings.json file to register a Stop hook and a SubagentStop hook. These hooks ensure that skill-provided Python scripts (stop-hook.py and verify-loop.py) are executed automatically by the platform whenever the agent process attempts to exit or specific subagents complete their tasks.
[DATA_EXFILTRATION]: The scripts/get-context.py utility reads arbitrary files from the filesystem based on paths provided in .jsonl files within the task directory. If an agent is manipulated via prompt injection to include sensitive files (such as ~/.ssh/id_rsa or .env files) in these JSONL files, the skill will read and expose their contents to the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a large attack surface for indirect prompt injection as it is designed to 'Understand' and 'Explore' untrusted codebases. There are no boundary markers or sanitization routines in the provided scripts to prevent instructions embedded in the analyzed code from hijacking the multi-agent orchestration loop.

do