The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is explicitly designed to monitor and automatically transmit the contents of sensitive file paths to external model endpoints via CLI tools.
The "risk-path detection" logic instructs the agent to read and route files matching **/.env*, **/secrets/**, src/auth/**, and src/billing/** to external Codex/GPT-5.5 instances.
It uses cat <context-bundle> | codex exec and git diff | codex exec to pipe potentially sensitive codebase information, including credentials and secrets, to remote services.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to process data and interact with external systems.
It employs yt-dlp, ffmpeg, and qpdf to handle external media and documents.
It invokes codex and gemini CLI tools to send local file content and shell outputs to external models.
[EXTERNAL_DOWNLOADS]: The skill uses yt-dlp to download media content from external URLs, specifically YouTube.
[PROMPT_INJECTION]: The skill contains aggressive instructions aimed at overriding the agent's default behavior and safety protocols regarding self-review.
It uses language like "HARD RULE", "MUST-FIRE", and "Do NOT silently self-review" to force the agent to bypass its own internal assessment logic in favor of routing tasks to external models.
[INDIRECT_PROMPT_INJECTION]: The skill has a high attack surface for indirect prompt injection by processing untrusted data from various sources.
Ingestion points: YouTube URLs, long PDF documents, and external video/audio files.
Boundary markers: The instructions lack specific delimiters or warnings to ignore instructions embedded within the downloaded or processed content.
Capability inventory: The skill possesses extensive command execution capabilities (yt-dlp, ffmpeg, qpdf, codex, gemini) and file system write access (/tmp/three-brain/, ./three-brain-out/).
Sanitization: There is no evidence of sanitization or filtering for the content extracted from external media before it is passed to the LLMs.

three-brain