The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/measure.sh script executes arbitrary shell commands provided via the measurement.command field in the optimization spec. This allows the agent or a user-provided configuration to execute any command within the repository environment.
[CREDENTIALS_UNSAFE]: The scripts/experiment-worktree.sh script automatically copies all .env files (excluding .env.example) from the repository root into temporary experiment worktrees created in .worktrees/. This practice increases the exposure of potentially sensitive API keys and secrets by duplicating them into multiple untracked directories.
[DYNAMIC_EXECUTION]: The skill provides a 'yolo' security posture for Codex execution (--dangerously-bypass-approvals-and-sandbox) as documented in references/optimize-spec-schema.yaml. This setting explicitly disables safety filters and sandboxing for the execution of experiment code.
[DYNAMIC_EXECUTION]: The scripts/measure.sh script dynamically executes a Python script provided via a heredoc and stdin to implement command timeouts, which bypasses static analysis of the executed logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files and user-provided optimization goals which are then interpolated into sub-agent prompts.
Ingestion points: Goal descriptions and spec file content (e.g., hypothesis descriptions) in SKILL.md and spec.yaml.
Boundary markers: The prompt templates in references/experiment-prompt-template.md and references/judge-prompt-template.md use structural XML-like tags but do not include explicit 'ignore instructions' delimiters for interpolated variables.
Capability inventory: The skill possesses extensive capabilities including shell command execution (measure.sh), git operations (experiment-worktree.sh), and network access via sub-agents.
Sanitization: No evidence of sanitization or validation of the content of the hypothesis_description or items_json variables before prompt interpolation.

ce-optimize