The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md explicitly direct the agent to override its default security and permission profile by setting settings.modeId to full-access (for Codex) or bypassPermissions (for Claude). This is a direct attempt to escalate the agent's capabilities beyond standard safety constraints.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and synthesizing data from numerous external, untrusted sources, creating a high-risk surface for indirect prompt injection.
Ingestion points: The skill reads pull request comments (references/sources/code-archaeology.md), issue tracker tickets (references/sources/linear.md), real-time chat messages from Slack or Teams (references/sources/slack.md), and long-form documentation from Notion (references/sources/notion.md).
Boundary markers: There are no explicit instructions or delimiters provided to the subagents to distinguish between legitimate data and potential malicious instructions embedded within the external sources.
Capability inventory: The agent has the capability to execute shell commands (git, gh), perform SQL queries (databricks.md), and spawn subagents with elevated permissions, which could be abused if an attacker places malicious instructions in a processed chat or ticket.
Sanitization: No evidence of sanitization, filtering, or validation is present before data from external sources is passed to the synthesis agent.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands in SKILL.md to establish context, including git blame, git log, gh pr view, and claude mcp list. These commands interact with the local environment and provider configuration.
[DYNAMIC_EXECUTION]: The references/sources/databricks.md component generates and executes dynamic SQL queries using the execute_sql_read_only tool. This involves runtime assembly of executable database code based on agent interpretation of the user's question.

why