The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md (Mode: start) explicitly request the agent to run background commands with security sandboxing disabled (dangerouslyDisableSandbox: true). This bypasses standard platform security controls.
[PERSISTENCE]: The skill utilizes the /loop command to create a recurring heartbeat task every hour, ensuring the monitoring logic persists across agent sessions even when the main process is not active.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could influence agent behavior or output content.
Ingestion points: SKILL.md instructions (Step 4) direct the agent to read pull request diffs using gh pr diff and ticket data through a tracker MCP.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between internal instructions and ingested repository content, increasing the risk of instruction override.
Capability inventory: The agent can execute shell commands, write files to the local file system, and use the screenless CLI to send emails or place phone calls.
Sanitization: No sanitization or validation steps are performed on the ingested repository data before it is processed for reporting.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution, including running local Node.js scripts and external tools (git, gh). The PDF rendering process (press/bin/render.mjs) also executes headless Chrome with the --no-sandbox flag.
[DATA_EXFILTRATION]: The press/bin/render.mjs script includes logic to read local files and embed them into the generated PDF via the dataUri function. Since the content of the PDF is driven by repository data that could be influenced by an attacker through pull requests, this presents a risk of unauthorized local file exposure if the agent is manipulated into specifying sensitive file paths in the edition.json document.

morning-pr-review