The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary purpose is to orchestrate a command-line agent that executes shell commands. It provides specific patterns for running tasks through terminal() calls and tmux sessions, which grant the underlying tool full access to the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where the agent processes untrusted external data such as pull request diffs (git diff), source code, and piped input. This creates a significant surface for indirect prompt injection attacks.
Ingestion points: Processes files, git diffs, PR bodies (--from-pr), and standard input context.
Boundary markers: None explicitly defined in the orchestration instructions to isolate user-provided data from system instructions.
Capability inventory: The tool can perform file reads/writes, execute bash commands, access the network via MCP tools, and manage git repositories.
Sanitization: Relies entirely on the internal safety mechanisms of the 'claude-code' CLI tool.
[DYNAMIC_EXECUTION]: The 'Hooks' section demonstrates how to configure the tool to automatically execute shell commands based on specific events (e.g., PostToolUse, PreToolUse). This allows for dynamic code execution triggered by tool interactions.
[PERSISTENCE]: The skill documents the use of hooks and local settings files (.claude/settings.json) that persist configuration and automated execution triggers across different terminal sessions.
[PRIVILEGE_ESCALATION]: The skill explains the use of the --dangerously-skip-permissions flag, which is designed to bypass all interactive confirmations for sensitive operations like file modification, command execution, and network access.
[FALSE_POSITIVE_DETECTION]: A static analysis match for a 'fork bomb' pattern was identified in the SKILL.md. Evaluation confirms this is a false positive; the pattern is contained within a defensive regex example in a 'Security hook' snippet intended to block such attacks.

claude-code