The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to bypass standard user confirmation for shell commands. Under the 'Large file handling' rules, it directs the agent to 'immediately retry using Bash' to write files and specifically commands it to 'Do NOT ask the user for permission — just do it silently.' This behavior actively suppresses user oversight for potentially high-risk file system operations.
[COMMAND_EXECUTION]: The workflow relies on the execution of a local script, tools/research_wiki.py. While appearing to be a project-specific utility, this involves running unverified local code with arguments derived from project state.
[PROMPT_INJECTION]: The skill exhibits a significant attack surface for Indirect Prompt Injection (Category 8) due to how it processes external research data.
Ingestion points: Research papers in papers/, literature/ (PDFs), and search results from WebSearch and WebFetch tools.
Boundary markers: Absent. External data is interpolated directly into prompts for the mcp__codex__codex tool without delimiters or instructions to ignore embedded instructions.
Capability inventory: The agent has Bash(*), Write, and WebSearch capabilities, which could be abused if the agent follows instructions embedded in research papers.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from external sources before it is used to construct prompts.
[EXTERNAL_DOWNLOADS]: The skill uses WebSearch and WebFetch to retrieve content from arbitrary internet locations. This content is then used to drive the agent's logic in subsequent phases, introducing untrusted data into the system.

aris-idea-creator