The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill documents and promotes the use of shell wrappers for AI agents (such as Claude and Codex) that explicitly include flags like --dangerously-skip-permissions and --dangerously-bypass-approvals-and-sandbox. These flags are designed to circumvent the security controls and sandbox protections of those agents, significantly increasing the risk of unauthorized or harmful actions being executed without user approval.
[COMMAND_EXECUTION]: The documentation for the post_command_discovery_hook feature describes a mechanism that executes shell commands via sh -c using strings derived from the ps command output. This architecture introduces a risk of command injection if the process metadata (e.g., process arguments) is manipulated by a malicious process on the system.
[INDIRECT_PROMPT_INJECTION]: The skill's operational logic ingests data from external, untrusted system sources to drive its automation, creating an indirect prompt injection surface.
Ingestion points: Data is collected from ps -ao ppid,args, ss -lx output, and NATS event envelopes (bloodbank.evt.agent.>) as described in references/agent-sessions.md and references/attention.md.
Boundary markers: The documentation suggests using basename matching and rejecting specific subcommands, but these are described as logical filters rather than security boundaries designed to prevent adversarial instruction injection.
Capability inventory: The skill utilizes zellij action (rename, focus, send-keys) and zellij pipe (communication with plugins), alongside arbitrary shell execution via hooks.
Sanitization: The skill acknowledges that broad substring matching led to command corruption, implying that robust sanitization is currently absent and must be manually implemented by the user.
[DYNAMIC_EXECUTION]: The skill facilitates the loading and execution of WebAssembly (.wasm) plugins and provides instructions for building these plugins and piping data to them at runtime using the zellij pipe command. This enables the execution of arbitrary compiled code within the workspace context.
[PERSISTENCE]: The skill manages persistence through user-level systemd services (e.g., zellij-workspace.service) and the Zellij session resurrection mechanism, which serializes and restores session state from disk. While these are intended features for workspace management, they provide a mechanism for maintaining a presence across system restarts.

zellij-workspace-ops