command-development — agentic threat model

Not certain from the listing — Assumes Claude Code's underlying foundation model. Primary threat is prompt injection manipulating the generation of slash commands to execute unintended payloads.

Not certain from the listing — Reads local reference documents on demand (frontmatter-reference, interactive-commands). Main threat is local file exfiltration or reading sensitive files via dynamic file references.

The skill orchestrates custom slash commands, dynamic arguments, and bash execution. Insecure tool integration or flawed command parsing could allow an attacker to inject malicious arguments into bash execution blocks.

Since the skill supports 'bash execution inside commands', it operates directly on the host system or container. Without strict sandboxing, this poses severe risks of host compromise, privilege escalation, and lateral movement.

Not certain from the listing — Mentions 'testing-strategies' reference docs, but does not specify active runtime guardrails, logging, or anomaly detection for executed bash commands.

Not certain from the listing — No explicit authentication, authorization, or policy enforcement mechanisms are detailed for restricting who can run or modify these custom commands.

Mentions 'marketplace-considerations' and 'plugin-dev'. There is a risk of developers publishing compromised or vulnerable slash commands to a shared marketplace, leading to supply chain attacks.