The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands and CLI tools, including git, gh (GitHub CLI), and AI-related tools like claude and codex to perform multi-model analysis.
[DYNAMIC_EXECUTION]: The instructions require the agent to write and execute custom proof scripts or tests that import project libraries. This process involves the generation and runtime execution of local code to verify the safety of changes.
[PRIVILEGE_ESCALATION]: The skill explicitly advises the agent on how to bypass security restrictions imposed on sub-agents. It suggests that if an arm (sub-agent) needs to prove a claim, the agent should 'drop the --disallowed-tools guard' or add '-s workspace-write', effectively stripping away safety filters and granting elevated write permissions that were otherwise restricted by the default configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, specifically pull request bodies, comments, and commit logs, which are known vectors for indirect prompt injection attacks.
- Ingestion points: External data is fetched using gh pr view --json title,body,comments and git log -p as described in SKILL.md.
- Boundary markers: The instructions do not define any boundary markers or delimiters to separate untrusted PR content from the agent's instructions.
- Capability inventory: The skill has access to shell execution, file system operations, and the ability to spawn sub-agents with reduced security constraints.
- Sanitization: There are no sanitization or validation steps for the content fetched from GitHub before it is processed by the agent.

blast-radius