The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the Symphony source code from a GitHub repository (https://github.com/odysseus0/symphony) and utilizes the mise tool to download and install Elixir and Erlang dependencies. It also uses npx to add external agent skills to the project.
[REMOTE_CODE_EXECUTION]: Instructions direct the user to run build commands (mix setup, mix build) and execute the Symphony binary (./bin/symphony) from the downloaded source code.
[PRIVILEGE_ESCALATION]: The skill configuration explicitly bypasses standard security guardrails by requiring a specific acknowledgement flag (--i-understand-that-this-will-be-running-without-the-usual-guardrails) and setting up agents with danger-full-access sandboxing.
[DATA_EXFILTRATION]: The skill accesses the LINEAR_API_KEY environment variable and uses it to transmit data to the Linear API (api.linear.app) via curl for workflow and project setup.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The system ingests external data from Linear tickets (titles, descriptions) via the Linear MCP interface as described in SKILL.md.
Boundary markers: The instructions do not define delimiters or specific safety instructions for handling untrusted content within ticket descriptions.
Capability inventory: Agents initiated by this skill possess high privileges, including the ability to write to the repository, create pull requests, and execute commands under a full-access sandbox.
Sanitization: There is no evidence of input validation or sanitization of the ticket data before it is processed by the autonomous agents.
[COMMAND_EXECUTION]: The skill executes various system and git commands (codex --version, gh auth status, git remote get-url) to verify the local environment and repository configuration.

symphony-setup