The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses and modifies files containing sensitive configuration and authentication data for other agents, specifically ~/.codex/config.toml and ~/.claude.json.
[PRIVILEGE_ESCALATION]: The instructions direct the agent to modify the security policy of another AI agent (Codex) by adding an allow-list rule to ~/.codex/rules/openrig.rules. This rule permits several command families (rig ps, rig capture, rig send, rig queue, rig status, rig whoami) to execute without the standard human-in-the-loop approval prompts.
[EXTERNAL_DOWNLOADS]: The skill performs a global installation of the @openrig/cli package from the NPM registry. While the package belongs to the vendor's namespace, global installations introduce persistent software into the user environment.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect injection.
Ingestion points: Untrusted data enters the agent context via rig capture (reading the screen output of sub-agents) and rig queue show (reading task descriptions generated by others).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading this data.
Capability inventory: The agent has the capability to execute shell commands (npm, rig), write files to home directories, and send commands into active terminal sessions via rig send.
Sanitization: The skill lacks sanitization or validation steps for the content retrieved from sub-agent screens before it is processed by the primary agent.
[COMMAND_EXECUTION]: The skill executes a wide range of system commands, including daemon management (rig daemon start), UI orchestration (rig terminal open), and interactive terminal control (rig send). It also identifies environment variables like OPENRIG_ACTIVITY_* as credentials, confirming the sensitive nature of the execution context.

rigs