The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides an explicit mechanism to launch agent sessions with 'permissions bypassed,' allowing tools to be executed without user confirmation, which circumvents standard AI safety controls.
[CREDENTIALS_UNSAFE]: The tool accesses and stages authentication data from private application directories, including ~/.claude, ~/.codex, and ~/.pi/agent, to authenticate worker sessions.
[DYNAMIC_EXECUTION]: During the launch process, the skill dynamically generates shell shims in the /tmp/csd-workers/bin/ directory and subsequently executes them.
[COMMAND_EXECUTION]: The skill executes various CLI tools (claude, codex, pi, tmux) and allows the resolution paths for these binaries to be overridden by environment variables such as CSD_CLAUDE_BIN, providing a path for executing unauthorized binaries.
[DATA_EXFILTRATION]: The csd adopt command reads historical session transcripts containing previous conversation context from ~/.claude/projects/.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a transparent relay for output from worker agents, creating a risk that instructions embedded in worker responses could influence the controller agent's subsequent behavior. 1. Ingestion points: The converse, read-turn, and read-events commands in the csd script. 2. Boundary markers: Absent; documentation states the tool is a transparent relay and returns output verbatim. 3. Capability inventory: Command execution via tmux, file writing for shims, and credential staging. 4. Sanitization: Absent; output is returned without validation or filtering.

driving-claude-code-sessions