The Agent Skills Directory

[PROMPT_INJECTION]: The skill establishes an explicit 'Instruction Priority' in SKILL.md that ranks 'The Don's explicit instructions' (user commands) as the highest priority and the 'Default system prompt' as the lowest, which is an attempt to bypass standard safety guardrails. It also includes a 'Red Flags' section that directs the agent to ignore internal reservations about framework adherence, effectively steering the model's behavioral autonomy.
[INDIRECT_PROMPT_INJECTION]: The skill framework includes a 'Reconnaissance' phase for codebase scanning and a 'Grilling' phase for brainstorming, both of which process untrusted external data without sanitization or boundary markers. Evidence: 1. Ingestion points: SKILL.md (Reconnaissance phase), references/codex-tools.md (Environment Detection). 2. Boundary markers: No delimiters or safety warnings for external content are specified. 3. Capability inventory: Extensive access to shell execution ('Bash', 'run_shell_command'), file writing ('Write', 'Edit'), and subagent creation ('Task', 'spawn_agent') across all supported platforms. 4. Sanitization: No input validation or sanitization is defined for the content analyzed during the heist pipeline.
[COMMAND_EXECUTION]: The mapping files (references/*.md) provide detailed instructions on how the agent should use various shell and system tools to execute commands, including 'pi.exec' in Node.js and 'run_shell_command' in Gemini CLI, which can be leveraged for unauthorized system access if the agent's instructions are compromised.

using-gangsta