The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation encourages the use of atomic primitive tools like bash to provide agents with maximum flexibility, which inherently enables arbitrary shell command execution within the agent's environment.
[REMOTE_CODE_EXECUTION]: The self-modification.md and architecture-patterns.md files describe patterns for agents to edit their own source code via write_file primitives, rebuild the application (e.g., npm run build), and restart themselves. This self-evolution loop allows for the dynamic generation and execution of code that may bypass traditional static security controls.
[DATA_EXFILTRATION]: The skill provides templates for building network-capable tools such as call_api and git_push. These are designed to allow agents to interact with external services and repositories, creating a potential pathway for transmitting sensitive workspace data or modified code to remote servers.
[PROMPT_INJECTION]: In self-modification.md, the skill explicitly describes "Self-Modifying Prompts" where the agent is granted the capability to read and rewrite its own system instructions. This pattern could allow an agent (or an attacker via indirect injection) to modify its core logic and bypass hardcoded safety constraints.
[COMMAND_EXECUTION]: The architecture-patterns.md file outlines an "Approval Gates" pattern but suggests that many file types (such as documentation, site content, or data) can be written immediately without human review, which provides a path for persistent malicious content injection.
[REMOTE_CODE_EXECUTION]: The dynamic-context-injection.md and shared-workspace-architecture.md files emphasize a design where the agent reads untrusted user-controlled files and injects their content directly into the system prompt. This architecture creates a significant surface for indirect prompt injection that could lead to unauthorized tool usage or data exfiltration.

agent-native-architecture