The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to modify the agent's security configuration file (settings.json) to allow certain commands to run without user confirmation. This inherently reduces the security boundary of the agent environment by bypassing human-in-the-loop approvals.
[DATA_EXFILTRATION]: The curated allowlist in ALLOWLIST.md includes commands such as env, printenv, git config --get *, and cat *. Adding these to an allowlist enables the agent to access and potentially exfiltrate sensitive information like API keys, environment variables, and arbitrary file contents without explicit user approval for each execution.
[REMOTE_CODE_EXECUTION]: The curated MCP allowlist includes mcp__chrome-devtools__evaluate_script and mcp__playwright__browser_evaluate. These tools grant the ability to execute arbitrary JavaScript within a browser context, which could be used to manipulate web sessions, steal cookies, or perform actions on behalf of the user in a browser.
[PROMPT_INJECTION]: The skill uses a heuristic-based classification (checking for verbs like 'get' vs 'set' in tool names) to automatically allowlist new MCP tools discovered during runtime. This classification logic can be bypassed by maliciously named tools (e.g., a tool named read_and_delete_database), leading to the accidental allowlisting of destructive or high-risk operations.

configure-allowlist