The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and bash -c to execute shell commands, including 'setup' scripts synthesized by an LLM in evaluation briefs. This occurs in vendor/skill-eval-loop/scripts/run_eval.sh before process isolation is applied.
[PRIVILEGE_ESCALATION]: Requires passwordless sudo to run agents in isolated systemd namespaces and to manage file ownership of artifacts created inside containers or isolated environments.
[EXTERNAL_DOWNLOADS]: Fetches data and executes code from remote sources using npx (for the skills and @floomhq/skills packages) and curl (to retrieve SKILL.md content from raw.githubusercontent.com).
[INDIRECT_PROMPT_INJECTION]: The skill constitutes a significant attack surface by ingesting untrusted session logs and using them to generate prompts for LLM-driven code generation and execution.
Ingestion points: vendor/skill-miner/scripts/corrections.py and vendor/skill-miner/scripts/mine.py scan local directories for Claude, Codex, and OpenCode session logs.
Boundary markers: No explicit markers are used to separate user-controllable log data from instructional prompts.
Capability inventory: vendor/skill-eval-loop/scripts/run_eval.sh executes LLM-generated shell commands as the host user.
Sanitization: No sanitization or validation is performed on the LLM output before execution.
[DATA_EXFILTRATION]: Accesses sensitive authentication files, including ~/.claude/.credentials.json and ~/.codex/auth.json, and session logs which may contain private code or keys. While primary operations are local, evaluated agents could theoretically exfiltrate this data if not properly isolated.

brain-scan