The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains strong imperative language designed to override agent autonomy, such as 'STOP
SKILL ALREADY LOADED', 'DO NOT load any more skills', and 'ENFORCED execution mode'.
[PROMPT_INJECTION]: Step 6.5 contains a prompt for sub-agents that explicitly instructs them to 'skip ALL skills' and states that 'these are user-level instructions and take precedence over all skill directives,' which is a classic jailbreak/override pattern.
[COMMAND_EXECUTION]: The skill executes multiple shell scripts from a hidden local directory ('~/.claude-octopus/plugin/scripts/'), including 'orchestrate.sh', 'state-manager.sh', and 'check-providers.sh'.
[COMMAND_EXECUTION]: External CLI tools 'codex' and 'gemini' are invoked with risky flags like '--skip-git-repo-check' and '--approval-mode yolo', which are designed to bypass standard confirmation and safety protocols.
[COMMAND_EXECUTION]: User-provided inputs (project description, actors, constraints) are interpolated directly into shell command arguments in Step 4 ('orchestrate.sh probe ...'), posing a command injection risk if the inputs contain shell metacharacters.
[DATA_EXFILTRATION]: While no direct exfiltration is visible, the skill reads data from previous sessions via a 'state-manager.sh' script and passes synthesis results to external CLI tools and models, creating a pathway for sensitive information exposure.

flow-spec