The Agent Skills Directory

Privilege Escalation via Sandbox Bypass: The skill explicitly instructs the agent to use dangerouslyDisableSandbox: true when executing scripts to update project-local sandbox allowlists (e.g., in install.md and upgrade.md). This is a request to bypass standard security boundaries to facilitate configuration tasks.
Persistence via Git Hooks: The skill installs a post-checkout hook in the repository's .git/hooks/ directory (described in install.md and uninstall.md) to allow for automated reconciliation and environment synchronization.
Indirect Prompt Injection Surface (Agentic Overrides): The skill implements a model where the agent reads and interprets instructions from repository files. This creates an attack surface where external content can influence agent behavior. (1) Ingestion points: The skill reads project documentation, GitHub metadata, and dedicated override files. (2) Boundary markers: The skill includes an Injection-guard note and Hard rules to guide the agent. (3) Capability inventory: The skill possesses extensive capabilities including shell execution, file system management, and plugin management. (4) Sanitization: The skill relies on the agent's ability to follow safety guidelines.
Command Execution for Lifecycle Management: The skill performs various shell operations to install, upgrade, and reconcile the framework, including fetching remote resources and managing dependencies.
External Resource Management: The skill manages snapshots and external skill sets from remote repositories based on project-defined trust lists.

setup