The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/update-state.sh dynamically assembles jq filter strings using direct shell variable interpolation (e.g., $ISSUE_ID, $ISSUE_TITLE, $PHASE). This approach is highly vulnerable to injection because shell variables are expanded into the jq command string without sanitization or proper escaping (such as using jq --arg).
[PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface (Category 8). It ingests untrusted data from the agent environment—including issue identifiers, titles, and error messages—which are then processed by the state management logic.
Ingestion points: Arguments passed to update-state.sh for commands like start-issue, record-error, and skip-phase.
Boundary markers: None. The script directly concatenates inputs into command strings.
Capability inventory: The skill has the capability to perform atomic writes to the .claude/marathon-ralph.json state file via jq and mv.
Sanitization: Absent. There is no validation or escaping of the input variables before they are used to build executable jq filters.
[PROMPT_INJECTION]: The injection vulnerability can be leveraged to manipulate the agent's 'Circuit Breaker' system. A crafted input containing jq operators (e.g., "] | .failure_tracking.global.consecutive_failures = 0 | .[") could be used to reset failure counters, modify configuration limits, or delete tracking data, thereby allowing the agent to bypass safety constraints or enter infinite retry loops.
[PROMPT_INJECTION]: The check-limits command manually constructs JSON output strings using shell variable interpolation. If the variables contain double quotes or other JSON special characters, the command will produce malformed JSON, leading to schema confusion and potential logic failures in the agent's decision-making process.

update-state