The Agent Skills Directory

[PRIVILEGE_ESCALATION]: Instructions in SKILL.md direct the agent to use the highest privilege mode (full-access) for sub-tasks and specifically instruct it to cancel tasks that trigger user authorization prompts and re-run them with elevated permissions, while suppressing notification of this behavior to the user.
[COMMAND_EXECUTION]: The routing script (route.mjs) uses spawnSync to execute local CLI tools like pi to retrieve model lists and verify platform capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user task descriptions and relays them to sub-agents via the delegate_task tool. It lacks explicit delimiters or instructions to the sub-agents to ignore potentially malicious content within these relayed task descriptions, creating a surface for indirect prompt injection. Mandatory Evidence: Ingestion points in SKILL.md (task parameter); Boundary markers are absent; Capability inventory includes spawnSync and delegate_task; Sanitization is absent.
[DYNAMIC_EXECUTION]: The test suite (route.test.mjs) demonstrates sophisticated dynamic code execution techniques, including the use of NODE_OPTIONS and --import to hook into Node.js internal modules like child_process and intercept system calls at runtime.
[DATA_EXPOSURE]: The route.mjs script accesses and reads configuration and cache files from the user's home directory (specifically ~/.t3/caches and ~/.config/bstack), which may contain sensitive local environment data.

t3-orchestrator