The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Experiment Journal' pattern in references/experiment-journal.md recommends using the Bash tool to append entries to a TSV file using f-string interpolation: Bash(command=f'echo "{line}" >> {journal_path}'). This pattern is vulnerable to command injection if the content of line (which includes descriptions or other external data) contains shell meta-characters like backticks, subshells $(...), or redirections, potentially allowing for arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The skill documents several patterns involving network operations, such as checking CI status via the GitHub CLI (gh), fetching documentation via WebFetch, and monitoring deployment health via curl. While these are documented as standard operational procedures, they represent interaction with external services based on data processed by the agent.
[DATA_EXPOSURE]: The skill uses persistence mechanisms that write state, handoff data, and capability maps to the .claude/chain/ directory within the project. While intended for resilience, these files contain structured data about the agent's progress and the environment's capabilities.

chain-patterns