The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill executes external AI agents with command-line flags specifically designed to bypass built-in security sandboxes and permission request systems.
Evidence: The skill launches agents using codex --dangerously-bypass-approvals-and-sandbox and claude --dangerously-skip-permissions (SKILL.md).
[COMMAND_EXECUTION]: The skill dynamically builds and executes shell commands in separate terminal surfaces via a multiplexer.
Evidence: It uses the cmux send tool to pass command strings, including the unsandboxed agent launch commands, to new workspace surfaces (SKILL.md).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data (code changes and specifications) and passes them to an AI agent running without security restrictions, creating an exploitable attack surface.
Ingestion points: Data is gathered from git diff HEAD and the contents of files within the .specs/ directory and review_rules.md (SKILL.md).
Boundary markers: The skill uses simple markdown headers (e.g., ## Diff) but lacks specific instructions to the reviewer agent to disregard potential instructions hidden within the data.
Capability inventory: The spawned reviewer agent has shell access and is running with all security sandboxing and permission prompts explicitly disabled.
Sanitization: There is no evidence of sanitization or escaping of the ingested diff or specification content before it is transmitted to the secondary agent.
[DYNAMIC_EXECUTION]: The skill constructs and executes shell commands for launching agents based on runtime environment variables and logic.
Evidence: The skill selects between different reviewer commands and constructs the execution string based on the parent agent identity and user input (SKILL.md).

cmux-second-opinion