The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download a Docker Compose configuration and environment template from an untrusted GitHub repository (ghostwright/phantom). These files define the core execution environment and security boundaries for the agent.
[PRIVILEGE_ESCALATION]: The provided docker-compose.yaml configuration mounts the host's Docker socket (/var/run/docker.sock) into the agent's container. This allows the agent to issue commands to the host's Docker daemon, effectively granting it root-level access to the host machine.
[COMMAND_EXECUTION]: The skill includes patterns for executing shell commands via child_process.exec. While used for infrastructure tasks like provisioning databases, this capability can be abused to run arbitrary commands on the system.
[DYNAMIC_EXECUTION]: The skill features a 'Self-Evolution Engine' and 'Dynamic MCP Tool Registration.' These systems allow the agent to propose, validate, and apply changes to its own logic and create new executable tools at runtime based on AI-generated content.
[DATA_EXFILTRATION]: The agent is designed to communicate across multiple external channels, including Slack, Telegram, Email, and Webhooks. It also records 'memories' containing user interactions and potentially sensitive data in a vector database (Qdrant), creating multiple avenues for data exposure or exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources (webhooks, chat messages) and incorporates this data into its long-term memory. This memory is then interpolated into the system prompt, creating a significant surface for indirect prompt injection attacks.

phantom-ai-coworker