The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly spawns subagents with flags that disable all safety filters and user approval prompts.
Evidence in scripts/subagent: Claude subagents are launched with the --dangerously-skip-permissions flag.
Evidence in scripts/subagent: Codex subagents are launched with the --dangerously-bypass-approvals-and-sandbox flag.
[DATA_EXFILTRATION]: The scripts/sessions utility reads and exposes private conversation history transcripts.
It searches for and parses .jsonl files in ~/.claude/projects and ~/.codex/sessions (or custom config directories).
It extracts user prompts and assistant responses from these files to be read as data by the agent.
[COMMAND_EXECUTION]: The skill provides mechanisms to execute arbitrary shell commands in new terminal panes via the subagent run command.
[INDIRECT_PROMPT_INJECTION]: Several features create an attack surface for indirect prompt injection.
The sessions tool reads historical transcripts; if a previous conversation was influenced by an attacker, reading it could re-inject malicious instructions.
The subagent poke command specifically allows data from "outside" sources (like a local server) to be injected into the main agent's conversation stream.
[PERSISTENCE]: The scripts/subagent tool spawns a background monitoring process that persists beyond the initial execution.
The ensure_watcher function uses nohup and perl to create a detached session running watch.lua to monitor the Rex environment for events.

rex-subagents