The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file templates/phase4-loop.md contains instructions to clone an untrusted repository from github.com/frankbria/ralph-claude-code.git and execute ./install.sh, allowing for unverified remote code execution from a third-party source.
[COMMAND_EXECUTION]: In SKILL.md, the skill uses the Task tool with mode: "bypassPermissions" to execute sub-tasks, which intentionally circumvents the security model and privilege boundaries designed to limit subagent actions.
[COMMAND_EXECUTION]: Setup instructions in templates/phase0-equip.md create a settings.local.json configuration file that grants the agent nearly unrestricted Bash(*) and Skill(*) permissions.
[EXTERNAL_DOWNLOADS]: The skill automatically installs multiple external tools, skills, and MCP servers from various remote sources during its setup phase without providing a mechanism for source verification or user approval.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: Untrusted data enters via the project description in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Full shell access (Bash(*)) and bypassPermissions mode are enabled for the agent. 4. Sanitization: Absent; external content is interpolated directly into prompts for generating implementation plans and source code.

steve2