The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the codex command with the --dangerously-bypass-approvals-and-sandbox flag. This explicitly disables security guardrails, allowing the agent to perform privileged operations and filesystem access without user approval or environmental restrictions.
[REMOTE_CODE_EXECUTION]: The 'Callback Contract' mechanism involves the dynamic generation and injection of shell commands (using tmux-bridge message and tmux-bridge keys) into separate execution contexts (other tmux panes). This allows one agent process to execute arbitrary shell code in another process's environment.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using tmux and tmux-bridge based on environment-derived variables like project names (from git rev-parse) and pane IDs. While some basic regex filtering is applied to project names, the overall execution model relies on shell execution of untrusted or environment-controlled strings.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its automated decision-making process based on external file content.
Ingestion points: The skill reads and processes the content of review.md, test.md, and git diff output to decide whether to 'auto-fix' or continue execution.
Boundary markers: There are no boundary markers or instructions to treat the content of these files as data rather than instructions.
Capability inventory: The skill possesses the ability to execute shell commands, manipulate tmux panes, and spawn new agents without sandboxes.
Sanitization: No sanitization or validation is performed on the content read from the workspace files before it influences the agent's logic flow.

eo-flow