The Agent Skills Directory

[PROMPT_INJECTION]: The main skill instructions in SKILL.md include directives intended to override platform-level security constraints. Specifically, the instruction to "Set settings.modeId to full-access for Codex or bypassPermissions for Claude" is a direct attempt to circumvent safety filters and permission controls defined by the agent platform.
[PRIVILEGE_ESCALATION]: The skill attempts to acquire elevated access rights by commanding the agent to switch into full-access or bypassPermissions modes. This pattern seeks to grant the agent capabilities beyond its default restricted execution context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze arbitrary content from a codebase, which creates a potential vector for malicious instructions hidden in source code or comments to influence the agent.
Ingestion points: Content is ingested through filesystem tools like Read, Grep, and Glob as specified in references/explorer-prompt.md, and through the list_profiles command in SKILL.md.
Boundary markers: The prompt templates in references/explainer-prompt.md and references/explorer-prompt.md interpolate external data using {EXPLORER_FINDINGS_ALL} and {QUESTION} without providing explicit boundary delimiters or instructions to ignore commands found within the source data.
Capability inventory: The skill has the capability to read the local filesystem, execute profile-specific tools, and orchestrate multiple subagents with high-effort model settings.
Sanitization: There is no evidence of sanitization or safety filtering applied to the content retrieved from the codebase before it is used to generate the final synthesized explanation.

how