The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/lib/provider.sh defines functions such as run_claude_provider, run_codex_provider, and run_grok_provider that execute external AI agent binaries (claude, codex, grok) as subprocesses to perform autonomous coding and decision-making tasks.\n- [PRIVILEGE_ESCALATION]: The skill implements a 'Fresh-process contract' designed for headless operation, which explicitly bypasses standard security guardrails. As evidenced in scripts/lib/provider.sh, the skill launches sub-agents with flags including --dangerously-skip-permissions, --dangerously-bypass-approvals-and-sandbox, and --always-approve. These flags disable user-in-the-loop approvals and sandbox restrictions, granting the automated agent significant autonomy on the host system.\n- [DATA_EXFILTRATION]: The skill accesses system-level and user-level configuration files to resolve operational parameters. The claude_configured_value function in scripts/lib/provider.sh reads from sensitive paths including /etc/claude-code/managed-settings.json and hidden directories in the user's home folder (e.g., ~/.claude/settings.json), which may contain sensitive configuration data.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted repository data while safety filters are disabled.\n
Ingestion points: Markdown files within the target Git repository, such as tickets, specifications, and maps, are parsed by functions in scripts/lib/tickets.sh. The references/worker.md file also instructs agents to read project-specific rules like AGENTS.md and CLAUDE.md from the repository root.\n
Boundary markers: The build_prompt function in scripts/lib/runner.sh interpolates iteration context and workflow paths into the sub-agent's prompt without providing strong delimiters to distinguish instructions from repository data.\n
Capability inventory: The sub-agent possesses the capability to modify the file system, execute arbitrary shell commands via the provider binaries, and perform Git operations.\n
Sanitization: While logging utilities in scripts/lib/output.sh truncate and sanitize text for display, the untrusted content from the repository is passed directly into the AI agent's operational context.

autopilot