The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill is designed to launch sub-agents (builders) with significantly elevated permissions and relaxed security constraints. Evidence includes: dispatch.sh uses flags such as --dangerously-bypass-approvals-and-sandbox (for Codex), --dangerously-skip-permissions (for Claude in headless mode), and --always-approve (for Grok). dispatch.sh also configures OpenCode with a policy allowing all permissions ('{"permission":{"*":"allow"}}').
[COMMAND_EXECUTION]: The skill performs extensive shell command execution through dispatch.sh and handoff.mjs. It interacts with external tools including git, herdr, tmux, osascript, and multiple AI agent CLI tools. It also supports custom command templates defined in the user's configuration file.
[DYNAMIC_EXECUTION]: The dispatch.sh script dynamically generates temporary shell launch scripts (offload-launch.XXXXXX.sh) containing environment variable exports and shell commands, which are then executed via bash in new terminal sessions or windows.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection where the Architect agent processes data generated by a potentially untrusted Builder agent.
Ingestion points: The handoff.mjs script reads and parses sections from markdown handoff files (e.g., handoff.md) in SKILL.md logic, which contain the Builder's status, work summary, and gate results.
Boundary markers: The system relies on markdown headers (## Gate results, ## Work summary) to separate sections, but lacks explicit instructions for the Architect to ignore malicious content or instructions embedded in the Builder's reporting.
Capability inventory: The skill has broad capabilities including arbitrary command execution via dispatch.sh, file system writes through handoff.mjs, and full repository access via its sub-agents.
Sanitization: There is no evidence of sanitization or filtering applied to the text read from the handoff sections before it is presented to the Architect agent.

offload