The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill automates the configuration of pre-approved tool permissions in .claude/settings.local.json, granting the agent broad shell access (e.g., bash, powershell, chmod) and bypassing standard per-command authorization prompts for future actions in the project.
[COMMAND_EXECUTION]: Provides automated allowance for powerful utilities including package managers (npm, pip, cargo, uv), version control (git, gh), and container management (docker, docker-compose), which are capable of executing arbitrary code without further user confirmation.
[DATA_EXFILTRATION]: Grants pre-approval for network-capable tools such as curl, http (HTTPie), and firecrawl. This establishes a potential exfiltration path for project data or environment variables if the agent's behavior is influenced by malicious instructions.
[INDIRECT_PROMPT_INJECTION]: The skill significantly expands the attack surface for indirect prompt injection by pre-approving a wide array of execution and network tools, enabling high-impact actions to be triggered by untrusted data processed in future sessions.
Ingestion points: The skill writes persistent instructions and tool preferences to the .claude/rules/ directory to influence future agent behavior.
Boundary markers: Absent. The generated rules do not include specific delimiters or warnings to ignore embedded instructions in external data.
Capability inventory: 74 distinct shell commands are granted auto-approval status, including interpreters and network clients across SKILL.md Step 3.
Sanitization: No validation or sanitization is applied to the commands being allowed or the data they might process.
[CREDENTIALS_UNSAFE]: The skill implements a security best practice by automatically configuring .gitignore to exclude .claude/settings.local.json. It correctly identifies that this file is a high-risk location for user-specific API keys and tokens and proactively prevents them from being committed to the repository.

setperms