The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include a verification phase (Phase 3) that executes shell commands using zsh -l -c or bash -l -i -c. This executes a setup script constructed by the agent from repository evidence, resulting in arbitrary local command execution.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the repository being onboarded.
Ingestion points: Phase 1 reads package.json, .gitignore, and other local configuration files to build the manifest inventory (file: SKILL.md).
Boundary markers: There are no specified delimiters or instructions to ignore embedded commands within the ingested repository data.
Capability inventory: The agent can execute shell scripts, manage git worktrees, and perform file system operations including cp and rm across all scripts.
Sanitization: The instructions do not require sanitizing data extracted from repository files before using it in the dynamically executed setup scripts in Phase 3.
[DATA_EXPOSURE]: The workflow involves searching for and copying potentially sensitive files like .env, .claude/settings.local.json, and local secrets into new worktrees. While it advises against committing these files, the skill actively processes and copies local credentials (file: SKILL.md).
[DYNAMIC_EXECUTION]: The skill assembles executable shell scripts at runtime using repository metadata and templates, which are then executed in a login shell to test the environment setup (file: SKILL.md).

init-jean-json