The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to spawn and delegate tasks to external CLI-based AI agents including codex, claude, cursor-agent, glm, kimi, grok, antigravity, gemini, opencode, and command-code.
Evidence: scripts/_builder.py constructs command-line arguments for these tools, and scripts/_executor.py uses subprocess.Popen to execute them.
[PRIVILEGE_ESCALATION]: The skill implements a 'permission' system for sub-agents that includes a 'yolo' level, which explicitly bypasses safety mechanisms and sandboxes of the underlying CLI tools.
Evidence: In scripts/_builder.py, the yolo permission mapping includes flags such as --dangerously-bypass-approvals-and-sandbox (for Codex), --dangerously-skip-permissions (for Claude), and --yolo (for Command-Code).
Evidence: references/codex.md explicitly instructs the agent to use escalated permissions to avoid sandbox restrictions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external agent definitions from Markdown files, which determine the system context and permission levels of the sub-agent.
Ingestion points: scripts/_loader.py reads .md and .txt files from the .agents/ directory or a path specified by the SUB_AGENTS_DIR environment variable.
Boundary markers: The skill uses basic headers like [System Context] and [User Prompt] in scripts/_constants.py to separate instructions, but lacks robust isolation between the definition file content and the user request.
Capability inventory: The sub-agents executed via scripts/_executor.py have significant capabilities including file system access and bash execution (especially when the yolo permission is used).
Sanitization: The skill uses shell=False for process spawning to prevent command injection, but does not sanitize the natural language instructions extracted from the definition files before passing them to the sub-agent.

sub-agents