The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions explicitly direct the agent to 'Run unsandboxed as described in ../jobs/references/troubleshooting.md (escalated execution in Codex).' This is an attempt to bypass the security sandbox designed to restrict the agent's actions on the host machine, granting the skill and its sub-tasks higher privileges than intended by the platform defaults.
[COMMAND_EXECUTION]: The skill requires the execution of a local companion script using the Node.js runtime: node "<skill-dir>/../../companion/agy-companion.mjs". This provides a direct path for executing arbitrary code through the agy-companion.mjs file.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and integrate results from external workers (referenced as 'AGY workers'). This creates an attack surface where a compromised or malicious worker could return instructions that the lead agent might obey when synthesizing the final result.
Ingestion points: The agent collects results through a jobs tool/interface after dispatching assignments.
Boundary markers: No specific delimiters or safety instructions are provided to prevent the lead agent from being influenced by malicious text within worker results.
Capability inventory: The lead agent can write brief files, execute the Node.js companion script, and read/write to the filesystem.
Sanitization: There is no evidence of sanitization or filtering of the content returned by workers before it is processed by the lead agent.

lead