The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local companion script using Node.js to delegate tasks to worker personas.
Evidence: node "<skill-dir>/../../companion/agy-companion.mjs" staffer --prompt-file "<brief-path>" in SKILL.md.
[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to operate outside of standard sandbox constraints and utilize escalated execution privileges.
Evidence: "Run unsandboxed as described in ../agy-jobs/references/troubleshooting.md (escalated execution in Codex)" in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a coordinator that ingests and integrates output from external worker agents, creating a vulnerability where instructions embedded in worker results could influence the lead agent.
Ingestion points: Results gathered from the jobs mechanism as described in SKILL.md.
Boundary markers: The instructions mandate the preservation of exact worker content (quotes, figures, errors) without specifying the use of delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill can execute local Node.js scripts, write briefs to temporary files, and integrate results into the primary session.
Sanitization: No sanitization, escaping, or filtering of worker-generated content is defined in the workflow.

agy-lead