The Agent Skills Directory

[COMMAND_EXECUTION]: The skill exposes shell::exec and shell::exec_bg for running arbitrary Unix commands on the host. The instructions admit that the host-targeted execution denylist is a "regex tripwire" that can be bypassed by interpreters such as sh, node, and python3.
[PRIVILEGE_ESCALATION]: Through shell::fs::chmod, the agent can modify file permissions and change ownership properties (uid and gid), which are high-privilege operations that can alter the system's security posture.
[DATA_EXFILTRATION]: The skill provides tools like shell::fs::read, shell::fs::grep, and coder::read-file to access host filesystem data. Combined with the capability to execute network-capable commands, this provides a path for potential data exfiltration.
[DYNAMIC_EXECUTION]: The core functionality of the skill facilitates the dynamic execution of shell commands and scripts directly on the host, which represents a high-risk capability if used with untrusted input.
[PERSISTENCE]: The capability to write to the filesystem via shell::fs::write and run background processes via shell::exec_bg allows for the creation of persistence mechanisms that could survive beyond a single agent interaction.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files and command outputs that could contain malicious instructions designed to influence the agent.
Ingestion points: shell::fs::read, shell::fs::grep, and command outputs from shell::exec.
Boundary markers: The filesystem is "unjailed by default" and the skill relies on a denylist that the documentation describes as bypassable.
Capability inventory: Extensive capabilities including shell::exec, shell::fs::write, shell::fs::chmod, and shell::fs::rm.
Sanitization: The instructions do not mention sanitization or escaping of external content before it is processed by the agent.

ide