The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the AI agent to bypass sandbox restrictions by executing commands in the host context. It specifically targets blocks on keychain authentication, network access, and file system writes.
Evidence in SKILL.md: "Run Git and GitHub CLI commands through the host context when sandboxing blocks...", "Run Git writes outside the sandbox when .git is outside writable roots", and instructions to set sandbox_permissions: \"require_escalated\".
Evidence in agents/openai.yaml: allow_implicit_invocation: true allows the agent to trigger this bypass behavior automatically without explicit user instruction.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests data from external Git and GitHub sources and executes commands on the host based on that data.
Ingestion points: The skill reads output from git status -sb, git remote -v, and gh ... view commands (SKILL.md).
Boundary markers: None identified. There are no instructions to ignore potential prompts embedded in PR descriptions or commit messages.
Capability inventory: The skill can execute git add, git commit, git push, gh repo, and gh pr operations directly on the host system (SKILL.md).
Sanitization: None identified. The skill does not describe any validation or escaping of the data fetched from remote repositories before it is used to inform host-level actions.

github-outside-sandbox