The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The example script agent-stop-notification.sh (embedded in references/real-world-examples.md) is vulnerable to command injection via unsanitized file input. \n
Evidence: The script reads variables like AGENT_NAME and TASK_NUMBER from .claude/multi-agent-swarm.local.md and passes them directly to tmux send-keys -t "$COORDINATOR_SESSION" "$NOTIFICATION" Enter. \n
Risk: Because these fields are extracted from a local file without sanitization, an attacker who can influence the settings file could inject shell commands. When the script sends the 'Enter' key to the tmux session, the injected commands would execute in the context of the terminal running in that session. \n- PROMPT_INJECTION (LOW): The ralph-wiggum example in references/real-world-examples.md introduces a significant indirect prompt injection surface. \n
Ingestion points: .claude/ralph-loop.local.md (read by hooks/stop-hook.sh in references/real-world-examples.md). \n
Boundary markers: None present; the file body is read directly into the prompt. \n
Capability inventory: Session loop control and prompt re-injection via the block decision in the stop hook. \n
Sanitization: None; the script extracts the markdown body and uses it as the 'reason' for blocking, which the agent treats as its next instructions. \n
Risk: This represents an autonomous loop (Category 8b) where the agent's behavior is driven by the content of a local file that could be poisoned by external data. \n- SAFE (INFO): The primary utility scripts, parse-frontmatter.sh and validate-settings.sh, follow security best practices by using atomic file operations and standard parsing tools like sed and awk without resorting to dangerous functions like eval.

plugin-settings