The Agent Skills Directory

[COMMAND_EXECUTION]: The skill programmatically invokes external AI CLI tools including claude, codex, and grok using flags that are designed to bypass all human-in-the-loop approvals and security sandboxes, such as --dangerously-skip-permissions, --dangerously-bypass-approvals-and-sandbox, and --always-approve.
[PRIVILEGE_ESCALATION]: By using these specific bypass flags, the skill elevates the operating permissions of the agent from a restricted, interactive mode to a fully autonomous state. This removes critical safety boundaries that require user confirmation for file changes or command execution.
[CREDENTIALS_UNSAFE]: The scripts/lib/provider.sh script is designed to read sensitive configuration files from the user's home directory, specifically ~/.claude/settings.json, ~/.codex/config.toml, and ~/.grok/config.toml. These files are known to store authentication tokens and API keys for AI service providers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests markdown files (tickets, specs, and maps) from the target repository and uses them to guide the actions of high-privilege autonomous workers, creating a vulnerability surface for injected instructions.
Ingestion points: Markdown files located in .scratch/, tickets/, and spec.md processed via scripts/lib/tickets.sh.
Boundary markers: None identified; the prompt construction in scripts/lib/runner.sh interpolates raw data from these files without security delimiters.
Capability inventory: Full shell command execution is available through the underlying provider CLIs.
Sanitization: No sanitization or safety-specific validation is performed on the content of the ticket files before processing.
[DYNAMIC_EXECUTION]: The scripts/lib/provider.sh script executes an embedded Python script block by piping it directly to the python3 interpreter, which constitutes runtime execution of local code strings to process log data.

autopilot