The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_agent.py executes the agy binary using subprocess.Popen to process agent tasks.
[COMMAND_EXECUTION]: The agy command is invoked with the --dangerously-skip-permissions flag, which is designed to suppress the tool's internal security confirmations and permission prompts during execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection within scripts/run_agent.py. The script assembles a final prompt by concatenating the contents of a persona file, an input source file, and a task instruction without sanitization or robust structural isolation. Malicious content within the ingested files could potentially override the intended sub-agent instructions.
Ingestion points: The persona_file and input_file arguments in scripts/run_agent.py (referenced in SKILL.md).
Boundary markers: Minimal text delimiters (---SOURCE---, ---INSTRUCTION---) are used but are easily bypassable by adversarial input.
Capability inventory: The system executes shell commands via subprocess.Popen and performs file system operations.
Sanitization: No escaping, filtering, or validation of the ingested file content is performed before interpolation into the prompt.
[COMMAND_EXECUTION]: The orchestration script modifies the process environment by prepending /opt/homebrew/bin to the PATH variable and performs directory creation (os.makedirs) based on the user-provided output_file path.

agy-cli-agent