The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to read ~/.claude/settings.json to retrieve the MINIMAX_API_KEY. This file is a sensitive platform configuration file that may contain multiple other service tokens and secrets, exposing the entire configuration to the agent context.
[COMMAND_EXECUTION]: The skill utilizes Bash(*) permissions to execute experiments, manage remote sessions via SSH, screen, and tmux, and perform file operations. This provides a broad attack surface for arbitrary command execution.
[DATA_EXFILTRATION]: The skill sends comprehensive project context, including research claims, methods, and results, to the external MiniMax API at https://api.minimax.io/v1/chat/completions. While this is the skill's primary function, it facilitates the transfer of potentially sensitive intellectual property to an external third-party service.
[DYNAMIC_EXECUTION]: In Phase C, the skill autonomously generates, writes, and modifies experiment scripts and analysis code, which are then executed via Bash. This runtime script generation and execution based on external input is a high-risk pattern.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from untrusted sources (external API responses and local research files) and uses that data to drive its autonomous "Implement Fixes" phase.
Ingestion points: Project narrative documents, memory files, and raw responses from the MiniMax API.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potentially malicious commands embedded in the review feedback or project files.
Capability inventory: The skill has full Bash access, the ability to Write and Edit files, and the ability to initiate SSH sessions.
Sanitization: The instructions lack any sanitization or validation steps for the feedback received before it is implemented as code changes or executed as commands.

auto-review-loop-minimax