The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill contains explicit instructions for the agent to bypass standard security boundaries. It commands the agent to run its core functionality "unsandboxed" and to "request escalated permissions" from the host platform. It further mandates the use of a --dangerously-skip-permissions flag, which is described as an "unrestricted profile working as designed," intentionally removing safety constraints.
[PROMPT_INJECTION]: The instructions include directive language intended to override the agent's default safety protocols regarding command execution and sandboxing (e.g., "IMPORTANT: Run this command unsandboxed", "request escalated permissions for the command").
[COMMAND_EXECUTION]: The skill facilitates the execution of a Node.js companion script (agy-companion.mjs) located in the skill's directory structure. By instructing the agent to run this script outside of a sandbox, the skill grants it full access to the host environment, including the local network and filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill defines a significant attack surface for indirect injection by requiring that user-provided task descriptions be passed "verbatim" to the underlying command-line tool.
Ingestion points: User-supplied task description passed via the --prompt argument in SKILL.md.
Boundary markers: None identified; instructions explicitly state to pass text verbatim without sanitization.
Capability inventory: The skill has access to node, git, and gh (GitHub CLI) via the Bash tool, allowing for code modification, credential usage, and remote repository interaction.
Sanitization: Absent. The instructions prohibit pre-implementing or cleaning up the input, which bypasses potential filtering steps.

implementer