The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The documentation and guides provided within the skill explicitly instruct the agent to launch sub-agents using flags that bypass security guardrails. Specifically, it recommends using claude --dangerously-skip-permissions and codex --dangerously-bypass-approvals-and-sandbox. These flags disable permission prompts and sandbox protections in the worker runtimes, allowing them to perform potentially dangerous actions without user oversight.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted external data.
Ingestion points: Data enters the context from GitHub issue bodies (via gh issue view) and various specification files like tasks.md and requirement.md.
Boundary markers: The instructions do not define clear delimiters or use "ignore embedded instructions" warnings when passing this data to worker skills.
Capability inventory: The skill can execute shell commands (git, gh, find) and interact with terminal surfaces via cmux.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external sources before it is interpolated into prompts or used in command construction.
[COMMAND_EXECUTION]: The skill relies on extensive shell command execution to manage the development workflow. The cmux dispatch logic involves assembling and sending command strings to terminal surfaces. If the input data (such as branch names or task descriptions) is manipulated via the injection vectors described above, it could lead to arbitrary command execution on the host system.

spec-implement