The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to launch sub-agents with the --dangerously-skip-permissions flag in SKILL.md. This bypasses the platform's security sandbox and user confirmation prompts, allowing sub-agents to execute sensitive shell commands and file operations without human oversight.
[DATA_EXFILTRATION]: In prompts/interview.md, the instructions state that 'Conveyor findings are always filed as GitHub issues on angusfretwell/skills'. This results in the automated exfiltration of internal codebase advisories, which may contain sensitive information about bugs, hazards, or architectural weaknesses, to a public external repository.
[COMMAND_EXECUTION]: The scheduler makes extensive use of the herdr tool to execute shell commands, manage workspaces, and send text directly to terminal panes (herdr pane send-keys). These commands are constructed using dynamic variables like issue IDs and activity names which could be manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including issue trackers, pull request descriptions, and the repository's source code. Because these inputs influence the behavior of sub-agents running with elevated privileges (due to the skipped permission checks), the skill is highly vulnerable to injection attacks.
Ingestion points: Untrusted content is read in prompts/plan.md (issue/code), prompts/code-review.md (code), and prompts/qa.md (code/app).
Boundary markers: The prompts do not define delimiters or instructions to ignore embedded malicious commands within the processed data.
Capability inventory: Sub-agents have broad access to the filesystem and shell, while the scheduler controls the terminal environment via herdr.
Sanitization: There is no logic present to sanitize external inputs before they are interpolated into prompts or used to construct commands.

conveyor