The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface. Ingestion points: It processes untrusted external data by capturing the stdout/stderr output of user-defined or inferred verify_command executions (e.g., npm test, curl) and reading the task description $ARGUMENTS in SKILL.md. Boundary markers: Absent. There are no boundary delimiters or explicit instructions to ignore embedded prompts within the retrieved command outputs when they are added to .claude/pua-loop-history.jsonl or fed back to the model context. Capability inventory: The skill executes shell commands, runs local setup scripts, and performs multi-round autonomous file modifications without intervention. Sanitization: Absent. No data sanitization, content escaping, or filtering is applied to the external command outputs before they are re-evaluated by the agent.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute a local setup script via bash under the CLAUDE_PLUGIN_ROOT directory and run arbitrary verify_command strings specified by the user or inferred from the environment. This occurs within an autonomous framework that actively disables user confirmation checks via AskUserQuestion, increasing the potential impact of unexpected execution behaviors if untrusted input alters the task workflow.

pua-loop