The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The configuration in config/cli-config.yaml explicitly enables high-autonomy flags that bypass standard security prompts for several AI agent platforms.
Evidence: The auto_approve_flag for the claude and antigravity vendors is set to --dangerously-skip-permissions.
Evidence: The auto_approve_flag for the qwen and cursor vendors is set to --yolo.
Evidence: The auto_approve_flag for the kiro vendor is set to --trust-all-tools.
Finding: These settings allow sub-agents to perform sensitive actions (like writing to the filesystem or executing commands) without user oversight, effectively escalating their operational privileges.
[COMMAND_EXECUTION]: The skill relies on shell scripts to spawn and manage external CLI processes with the aforementioned high-autonomy flags, creating a pathway for unrestricted command execution.
Evidence: scripts/spawn-agent.sh and scripts/parallel-run.sh act as wrappers for oma agent spawn and oma agent parallel, which utilize the risky configurations defined in config/cli-config.yaml.
Finding: If a sub-agent is compromised or receives a malicious task, the lack of confirmation gates allows for immediate execution of arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection without sufficient sanitization or boundary enforcement.
Ingestion points: User requests are ingested and decomposed into prioritized tasks in SKILL.md (Entry step 2).
Boundary markers: The resources/subagent-prompt-template.md uses Markdown headers to structure assignments but lacks explicit instructions or delimiters that warn sub-agents to ignore instructions embedded within the provided data.
Capability inventory: The skill has the ability to spawn external processes, modify files within the workspace, and run verification scripts across SKILL.md and the scripts in the scripts/ directory.
Sanitization: There is no evidence of validation or sanitization mechanisms to filter user-controlled content before it is passed to specialized sub-agents.

oma-orchestration