The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to orchestrate the execution of external CLI-based AI agents (including agy, claude, agent, and codex). It teaches the agent how to invoke these system-level binaries to perform delegated subtasks, which grants the agent the ability to spawn new processes with access to the local shell and filesystem.
[PRIVILEGE_ESCALATION]: The instructions provide explicit guidance on how to use dangerous bypass flags to achieve fully unattended execution. This includes flags such as --dangerously-skip-permissions (Antigravity/Claude), --force and --yolo (Cursor), and --dangerously-bypass-approvals-and-sandbox (Codex). Using these flags removes human-in-the-loop safety checkpoints, potentially allowing an agent to execute arbitrary shell commands or network requests without user review.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting untrusted project data (e.g., repository content, diffs, and piped context) and passing it into subprocess agents. This creates a vulnerability where malicious instructions embedded in a codebase could be executed by the spawned agent, especially if permission-bypass flags are active.
Ingestion points: SKILL.md (Workflow Step 4), references/claude.md (Piped stdin), references/codex.md (Piped context and stdin).
Boundary markers: The skill suggests using self-contained prompts and constraints, but does not specify robust delimiters or sanitization protocols to isolate untrusted data.
Capability inventory: The spawned agents possess extensive capabilities, including file reading/writing, shell command execution, and network access (e.g., via read_url or MCP servers).
Sanitization: No automated sanitization or filtering of the ingested external data is described.
[CREDENTIALS_UNSAFE]: The skill documentation notes that spawned agents inherit persistent credentials and authentication tokens from local configuration directories (e.g., ~/.claude, ~/.gemini/antigravity-cli/settings.json). While it warns against hardcoding credentials in commands, the automated use of these high-privilege tokens by an unattended subprocess agent represents a risk of credential misuse.

spawn-agent