The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to bypass security controls by running commands "unsandboxed" and requesting "escalated permissions" to access sensitive files like OAuth tokens.
Evidence in SKILL.md: "Run this command unsandboxed — agy needs a localhost port and its OAuth token file, which harness sandboxes hide. In Codex, request escalated permissions for the command."
[PROMPT_INJECTION]: The skill uses "IMPORTANT" markers to instruct the agent to ignore standard security protocols (sandboxing) and seek higher privileges.
Evidence in SKILL.md: "> [!IMPORTANT]\n> Run this command unsandboxed..."
[COMMAND_EXECUTION]: The skill executes a local Node.js companion script using relative paths and user-provided arguments.
Evidence in SKILL.md: node "<skill-dir>/../../companion/agy-companion.mjs" ask [flags] --prompt "question"
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input and passes it verbatim to a command-line tool, creating a vulnerability surface for command or prompt injection.
Ingestion points: User questions passed via the --prompt flag in SKILL.md.
Boundary markers: Absent; instructions explicitly state to pass the question "verbatim".
Capability inventory: Shell execution capabilities using node and the Bash tool.
Sanitization: Absent; no filtering or escaping of user input is specified.

ask