The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs agents to perform a 'BOUNDED WRITE ESCALATION'. It provides a prompt template designed to persuade the AI to write to an absolute path outside the repository to bypass 'read-only' system constraints.
[PROMPT_INJECTION]: The skill uses specific override markers such as 'BOUNDED WRITE ESCALATION, this segment only' to bypass configured environment restrictions. This acts as a functional jailbreak against platform-imposed read-only protections.
[DATA_EXFILTRATION]: The instructions direct agents to read sensitive files located in the user's home directory, specifically '~/.claude/agents/X.md'. Accessing configuration files outside the project scope facilitates the collection of system-level metadata.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is fetching and processing untrusted external content from the web and literature, creating a large attack surface for indirect injection.
Ingestion points: External data enters via the 'WebFetch' tool as described in Check 2 of SKILL.md.
Boundary markers: None identified. The skill suggests a 'verification subagent' as a logical check but does not provide technical instructions for using delimiters or boundary markers to isolate untrusted content.
Capability inventory: The skill environment includes 'SendMessage', 'WebFetch', 'Read', 'Grep', and 'Bash', combined with the suggested ability to write to absolute file paths.
Sanitization: There are no instructions for sanitizing or escaping the content fetched from URLs before it is re-processed by the agent or included in messages.
[COMMAND_EXECUTION]: The skill encourages the automated execution of shell commands, such as 'grep', based on locators (file paths and line numbers) provided by untrusted subagents that have fetched external data.

subagent-research-reliability