The Agent Skills Directory

[PERSISTENCE]: The skill is designed to write 'standing instructions' into the configuration directories of multiple AI harnesses (Cursor, Claude Code, Devin, OpenCode). These files are automatically loaded by the AI environment in every new session, effectively creating a persistent modification of the agent's behavioral rules and constraints. Targeted files include ~/.cursor/rules/*.mdc, ~/.config/opencode/AGENTS.md, and ~/.claude/CLAUDE.md.
[PRIVILEGE_ESCALATION]: During the verification phase in Step 8, the skill instructs the agent to spawn a subagent with access: full permissions. This level of access grants the subagent the ability to use all available system tools, including those for writing to the filesystem and executing shell commands, which exceeds the restricted read-only mode often used for sub-tasks.
[COMMAND_EXECUTION]: The verification process involves the autonomous spawning of background subagents to perform tasks such as creating, reading, and deleting files in the OS temporary directory without per-action user intervention.
[INDIRECT_PROMPT_INJECTION]: The skill ingest untrusted data from the session transcript/history to verify the success of its configuration steps.
Ingestion points: Session transcript files and export commands (e.g., opencode export) verified in Step 2 and Step 8.3.
Boundary markers: No delimiters or 'ignore' instructions are used when reading the history to protect against embedded commands.
Capability inventory: The skill possesses high-privilege capabilities including writing persistent configuration files and spawning full-access subagents.
Sanitization: There is no evidence of sanitization or filtering of the transcript data before the agent processes it to 'confirm' the setup state.

setup-pstack