The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions explicitly command the agent to bypass the host platform's security controls by running commands "unsandboxed" and requesting "escalated permissions."
[CREDENTIALS_UNSAFE]: The skill directs the agent to access sensitive local data, specifically an "OAuth token file," noting that these credentials are deliberately hidden by standard security sandboxes.
[COMMAND_EXECUTION]: The skill executes a local Node.js script (agy-companion.mjs) using a relative path (../../companion/) that accesses files outside the skill's own directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied research topics and passes them "verbatim" to shell command flags, creating a potential command injection surface.
Ingestion points: User-provided research topic in SKILL.md.
Boundary markers: None; the agent is instructed to pass the user's research topic verbatim.
Capability inventory: Execution of shell commands via node with access to the local filesystem.
Sanitization: None; input is passed directly to the CLI command via the --prompt flag.
[COMMAND_EXECUTION]: The skill documentation indicates that the tool uses the --dangerously-skip-permissions flag by default for its "unrestricted" profile, which is a design pattern aimed at circumventing security checks.

agy-researcher