The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's 'Tester' role (found in role-specs/tester.md and roles/tester/role.md) executes npm test or npm run test:unit. This results in the execution of scripts defined in the analyzed project's package.json, which could lead to arbitrary code execution if the project being analyzed contains malicious test scripts.
[COMMAND_EXECUTION]: Several roles, including the Scanner, Diagnoser, and Implementer, utilize a specialized CLI tool (ccw cli) via Bash commands. While this appears to be a vendor-provided tool, it is used to perform analysis and write modifications to the codebase based on LLM outputs.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to the following evidence chain:
Ingestion points: The scanner and explorer roles ingest untrusted data by reading project source files (**/*.tsx, **/*.vue) and querying the codebase via the search_context tool.
Boundary markers: Analysis of the role specifications (roles/scanner/role.md, role-specs/scanner.md) reveals an absence of boundary markers or instructions to ignore embedded commands within the analyzed project files.
Capability inventory: The skill possesses significant capabilities, including the ability to write/edit files (Edit, Write), execute shell commands (Bash, npm test), and spawn sub-agents.
Sanitization: There is no evidence of sanitization or validation of the content read from the project files before it is used to influence the agent's logic or code generation phases.

team-ux-improve