The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The script scripts/pretrust-cwd.sh programmatically modifies the ~/.claude.json configuration file to set the hasTrustDialogAccepted field to true for various paths. This action is designed to bypass the "Workspace Trust" security feature of the Claude Code platform, which requires explicit user consent before allowing access to potentially sensitive project directories.
[DYNAMIC_EXECUTION]: Multiple scripts, including scripts/pretrust-cwd.sh and scripts/watch-agent.sh, utilize python3 - to execute inline Python code blocks. While used for JSON parsing and file monitoring, this represents dynamic execution of code embedded within shell scripts rather than discrete, static script files.
[COMMAND_EXECUTION]: The skill relies on a suite of utility scripts (spawn-pane.sh, reap-panes.sh, agent-pane-hook.sh) that interact deeply with the host system using tmux, ps, find, and stat. These scripts monitor process ancestor chains and manage terminal panes, which involves significant interaction with system processes.
[INDIRECT_PROMPT_INJECTION]: The skill features an automated "Fast Path" that ingests and processes external data such as directory structures, git logs, and subagent outputs from files like *.output. This creates an attack surface where malicious content within a project could influence the main agent's coordination logic or data summarization.
Ingestion points: scripts/watch-agent.sh (subagent output files), SKILL.md Step 0 (git logs, package.json, ONBOARDING.md, CLAUDE.md).
Boundary markers: SKILL.md defines explicit response anchors like "路由判定" and "预信任完成" to ensure procedural compliance.
Capability inventory: File system write access (pretrust-cwd.sh modifying ~/.claude.json), subprocess execution (tmux, ps), and subagent orchestration (Agent, SendMessage).
Sanitization: The skill uses Python-based JSON parsing to structure data, but the final content is interpolated into the main session's context with minimal filtering.

multi-agent