The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a section labeled 'Maximum Freedom Settings' which uses the 'CRITICAL' marker to force the agent to propose a local settings file (.claude/settings.local.json) designed to bypass security filters and permission constraints.
[PRIVILEGE_ESCALATION]: The scaffolding process explicitly configures the agent to run with excessive privileges in the created workspace. It requests allow_bash: ["*"], which grants the agent unrestricted command execution capabilities without the standard safety guardrails associated with specific tool usage.
[DATA_EXPOSURE]: The recommended configuration includes allow_read: ["~/**", "/tmp/**"]. This grants the agent (and potentially any malicious code it encounters) full read access to the user's entire home directory, exposing sensitive files such as SSH keys, AWS/cloud credentials, shell history, and personal documents.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from third-party sources (e.g., Fireflies.ai meeting transcripts) into the knowledge base. Because the skill also grants the agent unrestricted bash and file access, a malicious instruction embedded in a meeting transcript or note could be automatically executed with the agent's elevated permissions, leading to a compromise of the local system.
[EXTERNAL_DOWNLOADS]: The workflow encourages the global installation of external CLI tools (qmd) and various Node.js dependencies (orama) which are required for the semantic search features but are not pinned to specific versions, introducing standard supply chain risk.

secondbrain-init