The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs that sub-agents (Worker and Reviewer) should be spawned using a bypassPermissions mode. This is a direct attempt to override the platform's security and permission filters.
Evidence: Instruction in Team Composition table to use 'bypassPermissions' mode for Worker and Reviewer agents.
[COMMAND_EXECUTION]: The skill uses the shell to execute an external CLI tool (codex) on content derived from task descriptions. This involves writing data to temporary files and piping it into a command, which can lead to arbitrary code execution if the input data is compromised.
Evidence: Usage of 'codex exec' with input from temporary markdown files generated at runtime.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It reads tasks from Plans.md and delegates them to agents running with bypassed permissions, creating a vector for malicious instructions in the task data to be executed without standard security checks.
Ingestion points: Plans.md (task subjects and descriptions)
Boundary markers: No explicit markers or warnings to ignore instructions within the task data
Capability inventory: Bash, Write, Edit, Task, codex exec
Sanitization: No sanitization of task content before delegation

breezing