The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to operate in 'full permission mode', specifically referring to 'Claude Code's bypass permissions' and 'Codex's YOLO mode (no approvals, full-access sandbox)'. These instructions are designed to circumvent standard user approval workflows and platform security sandboxes.
[PROMPT_INJECTION]: The skill includes directives to override default model behavior and safety constraints by forcing 'max reasoning' and 'full permission mode'. It uses imperative language like 'never swap or downgrade' and 'if one is unavailable, stop' to override safety-oriented defaults.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injection:
1. Ingestion points: Processes external files, paths, and git diffs (SKILL.md).
2. Boundary markers: None present to distinguish between review instructions and the potentially malicious data being reviewed.
3. Capability inventory: Spawns sub-processes/threads, reads/writes files, and performs git commit/push operations (SKILL.md).
4. Sanitization: No escaping or validation of the input 'brief' data is specified before passing it to sub-models.
[METADATA_POISONING]: The skill description and reviewer list refer to fictional AI models such as 'Fable 5.1', 'GPT-6 Astra', and 'GPT-6.1 Sol'. These deceptive references may be intended to trick the agent or user into believing the system is operating with future or unrestricted capabilities.
[COMMAND_EXECUTION]: The skill provides specific command-line provider flags and arguments to be used when spawning new threads, instructing the agent to execute sub-processes with potentially dangerous configurations.

total-review