The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill implements an execution policy named 'danger_full_access'. When this policy is active, the controller script injects the '--dangerously-bypass-approvals-and-sandbox' flag into the agent CLI execution. This flag is designed to explicitly circumvent the platform's security sandbox and user approval requirements for sensitive operations.
[REMOTE_CODE_EXECUTION]: The skill facilitates autonomous, background code execution by launching a persistent controller process. This process repeatedly executes the agent CLI tool to perform tasks in the repository without direct user oversight for a default cap of 25 iterations.
[COMMAND_EXECUTION]: The 'scripts/harness_run_ctl.py' script uses the 'subprocess' module to execute external commands, including the agent CLI and system tools like 'taskkill' or 'kill' for process management. The controller loop dynamically builds and executes these commands based on runtime state.
[PERSISTENCE]: The skill establishes a persistence mechanism by running a detached background process (controller). This process manages the lifecycle of agent sessions, ensuring they are relaunched from a saved state across multiple rounds of execution.
[PROMPT_INJECTION]: The system instructions provided to the agent in the documentation and controller script contain directives to bypass standard safety checkpoints. Specifically, it instructs the agent that the 'launch contract is already confirmed' and to 'Do not ask for launch confirmation,' effectively silencing interactive security prompts.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is built to ingest and process various files from the target repository, such as 'AGENTS.md', 'README.md', and other project documentation. This creates an attack surface where malicious instructions embedded in these files could be executed by the agent while it is running autonomously in the background.
Ingestion points: 'scripts/harness_run_ctl.py' (via 'collect_repo_evidence' function) and instructions to read project files.
Boundary markers: None implemented; ingested content is treated as authoritative planning and architectural data.
Capability inventory: Full filesystem access, command execution, and persistence capabilities are available to the agent.
Sanitization: No sanitization or validation of the ingested repository content is performed before it is used to influence the agent's plan.

harness-run