The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/bash/setup-architect.sh uses node -e to evaluate JavaScript for parsing package.json. Specifically, it attempts to require the file and access the workspaces field: node -e "try { const p = require('./package.json'); ... } catch(e) { }". If a project contains a malicious package.json that executes code upon being required (e.g., via getters or specific module behaviors), this presents a code execution risk during the architecture initialization phase.
[REMOTE_CODE_EXECUTION]: While no remote downloads are present, the dynamic evaluation of local project metadata (like package.json mentioned above) constitutes a localized execution vulnerability that could be exploited if an attacker contributes malicious files to a repository the agent is analyzing.
[COMMAND_EXECUTION]: The instructions in SKILL.md explicitly direct the agent to execute shell scripts such as scripts/bash/setup-architect.sh. These scripts perform various filesystem operations including mkdir, cp, mv, and complex string manipulation using awk, sed, and grep on local files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from multiple sources.
Ingestion points: User-supplied input via $ARGUMENTS (e.g., project requirements) and existing architecture records located in {REPO_ROOT}/.adlc/drafts/adr/.
Boundary markers: None. The instructions do not specify delimiters or provide the agent with warnings to ignore embedded instructions within the ADRs or PRDs it processes.
Capability inventory: The skill has extensive filesystem write access (write_adr, move_adr, New-ArchitectureDiagrams) and can execute local scripts/interpreters (node, python3, bash, pwsh).
Sanitization: There is no evidence of sanitization or escaping of the ingested data before it is processed or written back to the filesystem.
[DATA_EXFILTRATION]: The detect_tech_stack functionality in both Bash and PowerShell scripts scans the project directory for sensitive configuration files, including docker-compose.yml, package.json, and manifest files for various languages. While no network exfiltration is currently implemented in the scripts, the broad access to project structure and configuration metadata provides the necessary information for potential exposure if the agent were manipulated via prompt injection.

architect-clarify