The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions to explicitly bypass safety guardrails and platform security constraints. The 'Launch permissions' section directs the agent to 'Never narrow --allowedTools, add tool deny lists, or sandbox a crewmate,' and mandates the use of unrestricted modes like '--auto' or '--always-approve' for sub-agents.
[REMOTE_CODE_EXECUTION]: The script scripts/crew-wake-supervise.sh allows for the execution of arbitrary, detached worker processes. The launch and supervise modes take a caller-supplied worker command and execute it in the background using nohup and setsid via a Python wrapper, allowing code to run independently of the main agent session.
[DATA_EXFILTRATION]: The supervision script reads sensitive application data from ~/.t3/userdata/state.sqlite and ~/.t3/dev/state.sqlite. It extracts orchestration metadata and session cursors from these local databases to facilitate its notification mechanism, which involves sending data to a local or remote T3_ORIGIN via curl.
[COMMAND_EXECUTION]: The skill utilizes shell scripts (scripts/crew-wake-supervise.sh) that interact with the system's process management and the t3 CLI to programmatically issue and revoke authentication sessions and steer agent threads.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via task briefs. Ingestion points: crew/<id>/brief.md referenced in SKILL.md. Boundary markers: The 'Authority Contract' is mentioned but no specific enforcement or delimiters are implemented in the provided scripts. Capability inventory: Arbitrary shell execution via scripts/crew-wake-supervise.sh and filesystem writes to the crew/ directory. Sanitization: No sanitization or validation of the brief content is performed before task execution.

crew-dispatch