The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the --dangerously-skip-permissions flag when executing the agy binary. This flag is documented to bypass all permission prompts, which removes human-in-the-loop safety gates and allows the sub-agent to execute actions without explicit user consent.
[COMMAND_EXECUTION]: The orchestration pattern involves constructing shell commands by interpolating user-controlled instructions and file content directly into command arguments (e.g., agy ... -p "$(cat target.py) ..."). This direct shell substitution is highly vulnerable to command injection if the processed files or instructions contain malicious shell characters or escaped sequences.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8):
Ingestion points: Untrusted data enters the context through files like target.py and direct <INSTRUCTION> parameters in SKILL.md.
Boundary markers: There are no XML delimiters, escape sequences, or specific instructions provided to the sub-agent to distinguish between system instructions and untrusted data content.
Capability inventory: The skill has access to Bash, Read, and Write tools, and executes commands through the agy binary, providing a significant impact vector for any successful injection.
Sanitization: The skill lacks any visible sanitization, validation, or filtering of the external content before it is processed by the sub-agent.

agy-cli-agent