The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes architectures where the agent reads external specification files (e.g., specs/component-spec.md, docs/auth-spec.md) and persistent task notes (SHARED_TASK_NOTES.md). These data sources can be influenced by third parties or malicious actors if the repository is not strictly controlled.
Ingestion points: The spec_file argument in the Infinite Agentic Loop, docs/auth-spec.md in the Sequential Pipeline, and SHARED_TASK_NOTES.md in the Continuous Claude Loop.
Boundary markers: The provided examples lack delimiters (like XML tags or triple-backticks) or explicit instructions to the agent to disregard instructions embedded within the data files.
Capability inventory: The loops utilize the claude -p interface, which typically grants the agent access to powerful tools including Bash, Write, Edit, Read, Grep, and Glob.
Sanitization: There is no evidence of content sanitization, validation, or escaping of the input files before they are processed by the agent.
[COMMAND_EXECUTION]: The skill documentation provides templates and shell script examples (such as daily-dev.sh) that automate the execution of Claude Code via the claude -p flag. While this is the intended functionality of the skill, the autonomous chaining of commands that can write to the filesystem and execute shell operations creates a risk if the agent's logic is subverted or if it misinterprets requirements. The skill also references a local script scripts/claw.js for persistent sessions.

autonomous-loops