The Agent Skills Directory

[COMMAND_EXECUTION]: The skill heavily relies on executing bash scripts for core functionality, including version control operations (stage-and-commit.sh, create-branch.sh), plan management (move-plan.sh), and environment detection (detect-vcs.sh, detect-branch.sh). These operations are performed directly on the local system within the project context.
[DYNAMIC_EXECUTION]: The script run-external-review.sh dynamically executes a command provided by the user via the configuration field ${user_config.external_review_cmd}. This design allows for arbitrary tool integration but introduces a risk where a malicious or poorly formed configuration string could lead to unintended command execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes plan files provided by the user (Markdown) and interpolates their contents into prompts for subagents. This creates a vulnerability surface where instructions embedded in a plan file might override the subagent's intended behavior.
Ingestion points: The PLAN_FILE_PATH is loaded in SKILL.md and passed into the task.md and fixer.md subagent prompts.
Boundary markers: While the prompts provide contextual structure, they lack explicit warnings or robust delimiters to instruct the subagents to ignore instructions contained within the plan file's data fields.
Capability inventory: Subagents are spawned in general-purpose mode with bypassPermissions, granting them autonomous access to tools like Bash, Agent, and Write to complete tasks defined in the plan.
Sanitization: There is no evident sanitization or filtering of the content within plan files before it is processed by the AI agents.
[DATA_EXFILTRATION]: The stats-summary agent is instructed to read internal session logs from ~/.claude/projects/ to aggregate metrics such as token usage and duration. While this data is presented to the user in a summary report, it involves the automated reading of sensitive agent history logs.

exec