The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes remote installation scripts via shell piping from well-known service domains.
Evidence found in templates/sandcastle/Dockerfile and templates/sandcastle/runtime.ts for Bun, Claude Code, Cursor, and Grok CLI installers (e.g., curl -fsSL https://bun.sh/install | bash). These are documented as safe well-known service interactions.
[COMMAND_EXECUTION]: Orchestrates complex shell environments across Docker, Firecracker microVMs (via Vercel Sandbox), and local runners.
Scripts like attempt-loop.ts and salvage.sh manage git lifecycles, artifact relocation, and automated branch maintenance.
[PRIVILEGE_ESCALATION]: Utilizes sudo within isolated sandbox environments to install necessary system dependencies.
templates/workflow/agent-implement.yml and templates/sandcastle/runtime.ts use sudo apt-get or sudo dnf to provision browser-testing tools like ffmpeg and Chromium dependencies.
[CREDENTIALS_UNSAFE]: Handles high-value repository secrets to facilitate automated repository operations.
Manages AGENT_PAT, CLAUDE_CODE_OAUTH_TOKEN, CODEX_AUTH_B64, CURSOR_API_KEY, GROK_AUTH_B64, and VERCEL_SANDBOX_TOKEN.
Employs strong mitigation through credential scrubbing in runtime.ts and attempt-loop.ts, ensuring agents only see the specific tokens required for their engine phase.
[DYNAMIC_EXECUTION]: Executes repository-controlled code within integrity gates.
templates/sandcastle/implement/convex-gate.ts runs real codegen and schema validation against anonymous local backends to prevent hand-edited machine output from being merged.
[INDIRECT_PROMPT_INJECTION]: Processes untrusted data from GitHub issues and agent-generated reports.
Ingestion points: ISSUE_BODY environment variable, Agent-generated PR descriptions, and Verification reports.
Boundary markers: Utilizes Markdown headers and explicit "UNTRUSTED DATA" warnings in generated prompts.
Capability inventory: Performs git pushes, repository secret updates, and Pull Request creation.
Sanitization: Implements a robust neutralizeHostileText utility in hostile-text.ts to strip HTML, links, and mentions before posting agent-controlled content to GitHub surfaces.
[SAFE]: Implements a proactive security feature assertControlPlane in attempt-loop.ts that verifies the integrity of the orchestration logic against a trusted git hash before executing credential-sensitive phases, preventing agents from escalating privileges by modifying their own runner environment.

afk-pipeline