The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts inspector.sh and worker-reviewer.sh utilize the --permission-mode bypassPermissions flag when calling the Claude CLI. This configuration allows the AI agent to execute tools, including shell commands and file modifications, without human review or confirmation for each action.
[PRIVILEGE_ESCALATION]: By invoking the agent with bypassPermissions, the skill escalates the agent's capabilities from a supervised assistant to an autonomous entity. This circumvents standard safety confirmations designed to prevent unauthorized actions and grants the agent broad authority over the local environment.
[PROMPT_INJECTION]: The skill implements a mechanism where user-provided text is stored in a temporary file (/tmp/harness-context.txt) and subsequently concatenated into the agent's system prompt without sanitization or strict encapsulation. This creates a vector for prompt injection where instructions can be overridden by a user or an external process.
[INDIRECT_PROMPT_INJECTION]: The agent is directed to ingest and act upon data from local project files that could contain malicious instructions.
Ingestion points: The skill reads TODO.md, AGENTS.md, CLAUDE.md, and README.md and interpolates their content into the prompt.
Boundary markers: The skill uses basic Markdown headers (e.g., ### TODO.md) but lacks robust delimiters or 'ignore embedded instructions' warnings for the ingested content.
Capability inventory: The agent possesses autonomous shell execution and file write capabilities via the bypassPermissions flag.
Sanitization: No sanitization, validation, or escaping is performed on the content of the ingested files before they are processed by the agent.
[PERSISTENCE]: The skill uses the CronCreate tool to schedule recurring agent tasks (e.g., every 30 minutes). While intended for automation, this mechanism allows for long-term execution of agent actions that persist across sessions for up to 7 days without continuous user presence.

harness