The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instruction files in references/playwright-agents.md and references/sub-agents.md explicitly recommend that users run the Claude Code agent using the --dangerously-skip-permissions flag. This flag, referred to as 'YOLO mode', is intended to increase productivity by suppressing manual approval prompts for tool executions. However, this practice significantly escalates risk by removing the human-in-the-loop security boundary, allowing the agent to perform potentially destructive or unauthorized actions—such as modifying system files or initiating network communications—without oversight.\n- [COMMAND_EXECUTION]: The skill guides the agent to execute various shell commands, including npx playwright init-agents, git, and the GitHub CLI (gh) for automated pull request management. While these are standard developer tools, the automation of these tasks, particularly when combined with the recommended permission bypass, creates a vector for automated code changes and repository interactions that bypass traditional human review steps.\n- [INDIRECT_PROMPT_INJECTION]: The skill's workflow depends on ingesting and processing external data from project files such as spec.md, CLAUDE.md, and handoff.md. This creates a surface for indirect prompt injection where malicious instructions embedded in these files could influence agent behavior. Ingestion points: The agent is instructed to read various documentation and plan files across all phases of development as specified in SKILL.md and references/post-dev-workflow.md. Boundary markers: The instructions do not define clear delimiters or warnings to ignore instructions embedded in the project data. Capability inventory: The skill encourages high-privilege operations including automated PR merges, code commits, and library installations via npx. Sanitization: There is no documented mechanism for sanitizing or validating the content of external project files before processing.

cc-dev-agent