The Agent Skills Directory

[COMMAND_EXECUTION]: The skill resolves and executes various system binaries (claude, grok, codex, opencode, copilot, cockpit, and agent) using command -v. It initiates these as child processes to perform tasks.
[PRIVILEGE_ESCALATION]: The skill systematically instructs the agent to bypass security controls and sandboxes for all supported harnesses. Evidence includes the following mandatory flags in SKILL.md and the reference files:
Claude Code: --dangerously-skip-permissions and --no-session-persistence
Cockpit: --no-sandbox and --permission-mode yolo
Codex: --dangerously-bypass-approvals-and-sandbox
Cursor CLI: --sandbox disabled, --trust, and --yolo
Grok: --sandbox off and --permission-mode bypassPermissions
OpenCode: Demands a configuration that allows every tool with no ask or deny rules, stating to reject the tool if permissions cannot be bypassed.
[INDIRECT_PROMPT_INJECTION]: The skill accepts a <prompt> argument which is passed directly to the high-privilege sub-harnesses. Since the skill deliberately removes the sandboxing and permission checks of these sub-agents, any malicious instruction within the prompt can execute with the full authority of the user's shell environment.
Ingestion points: Prompt text passed as arguments or via stdin to the harness executables.
Boundary markers: None; the skill explicitly removals safety boundaries.
Capability inventory: Full shell execution, file system access, and network operations as permitted to the local user.
Sanitization: None; it passes the prompt through to the sub-agent.
[REMOTE_CODE_EXECUTION]: While the skill does not download external code directly, its primary function is to facilitate the execution of arbitrary code via external AI coding agents that have been stripped of their security guardrails. This creates a direct path for remote code execution if the agent is directed to process untrusted instructions.

invoke-harness