The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx --yes md2idx in several scripts, including scripts/check-md2idx.sh, scripts/build-request.sh, scripts/build-response.sh, scripts/delegate-codex.sh, and scripts/delegate-x-research-grok.sh. This command downloads and executes the md2idx utility from the npm registry at runtime without version pinning.
[PRIVILEGE_ESCALATION]: Several delegation scripts utilize high-privilege flags to suppress user confirmation prompts and security warnings:
scripts/delegate-claude.sh uses the --dangerously-skip-permissions flag.
scripts/delegate-devin.sh uses the --permission-mode dangerous flag.
scripts/delegate-x-research-grok.sh uses the --permission-mode bypassPermissions flag.
scripts/delegate-cursor.sh uses the --trust and --force flags.
scripts/delegate-codex.sh defaults to a sandbox environment named danger-full-access via the CODEX_DELEGATE_SANDBOX environment variable.
[CREDENTIALS_UNSAFE]: The scripts/delegate-codex.sh script copies the auth.json file, which typically contains sensitive session tokens, from the user's standard Codex home directory to a temporary isolated work directory to maintain sub-agent authentication.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from X (Twitter), which may contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: Untrusted data is retrieved from X.com via the grok CLI and passed into the sub-agent's context in scripts/delegate-x-research-grok.sh.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the ingested content.
Capability inventory: The sub-agent environment possesses broad capabilities, including file system access (Bash, Read), network access (Grok), and the ability to execute downloaded tools (npx).
Sanitization: No sanitization, filtering, or escaping is performed on the content retrieved from X before it is processed by the model.

delegate-x-research