The Agent Skills Directory

[PROMPT_INJECTION]: The 'Agent Operational Directive' section uses authoritative language ('MANDATORY', 'Never block') to instruct the agent to bypass standard per-action confirmation prompts for workspace edits and file reads. This is an explicit attempt to override the platform's safety filters and user oversight mechanisms.
[INDIRECT_PROMPT_INJECTION]: The skill advocates for removing human-in-the-loop confirmations for individual actions, which significantly increases the risk that an agent will automatically execute malicious instructions found in external data.
Ingestion points: The skill suggests using tools like view_file and read_url_content to bring untrusted data into the context.
Boundary markers: There are no instructions provided to treat ingested data as untrusted or to use delimiters to prevent instruction leakage.
Capability inventory: The configuration advice encourages auto-approving high-impact tools like replace_file_content, write_to_file, and arbitrary command execution via npm run and git prefixes.
Sanitization: No sanitization or validation logic is proposed for handling data before it triggers these capabilities.
[COMMAND_EXECUTION]: The configuration examples recommend allowing broad command execution scopes, such as the git prefix. This includes network-capable commands (e.g., git push, git fetch) and configuration-modifying commands that should typically require explicit user review.

cached-tool-permission-grants