The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the claude CLI using the --permission-mode bypassPermissions flag. This configuration grants the paired agent the ability to execute tools and shell commands autonomously without requiring user approval, bypassing a fundamental safety control designed to prevent unauthorized actions.
[COMMAND_EXECUTION]: The skill implements logic to search for and execute a local JavaScript file (codex-companion.mjs) located within the user's plugin directory ($HOME/.claude/plugins/). This dynamic execution of scripts based on a directory search path could be exploited if an attacker manages to place or modify files in the plugin cache.
[PROMPT_INJECTION]: The skill enables an interaction loop between two AI agents, creating a significant attack surface for indirect prompt injection where malicious instructions can be passed through peer communication.
Ingestion points: Peer messages and task summaries passed between agents via the Agent tool results or the claude -p stdout.
Boundary markers: While the instructions suggest a structured "peer message" format, the skill lacks formal delimiters or guardrails to safely isolate untrusted data from the instructions processed by the paired agent.
Capability inventory: The skill leverages the Agent tool and shell execution of claude -p with full workspace directory access and suppressed permission prompts, providing an expansive surface for unintended command execution.
Sanitization: No automated validation or sanitization of the content exchanged between agents is performed; the skill relies entirely on manual user inspection of git diffs to detect malicious changes.

agents-pair