The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to spawn sub-processes and sub-agents using high-risk command-line arguments.
Evidence: references/substrates/orca-orchestration.md explicitly recommends running codex --dangerously-bypass-approvals-and-sandbox to prevent manual approval interrupts.
Evidence: references/substrates/claude-subagent.md mentions the use of claude --dangerously-skip-permissions for execution.
[PRIVILEGE_ESCALATION]: The skill utilizes specific bypass flags for CLI tools that effectively disable standard security guardrails, such as sandboxing and user confirmation prompts.
Evidence: The flags --dangerously-bypass-approvals-and-sandbox and --dangerously-skip-permissions are used to grant the sub-agent unrestricted execution capabilities within the host environment.
[INDIRECT_PROMPT_INJECTION]: As a workflow controller, the skill ingests content from untrusted external sources and worker agents to generate new instructions.
Ingestion points: Untrusted data is ingested from change.md frontmatter, evidence.md files, user intent strings, and completion reports from other agents (found in SKILL.md and references/substrates/).
Boundary markers: The skill mentions using a "Control Pack" (控制包) to scope instructions and "Interactive Hard Constraints" to limit calling conventions, though these are logical rather than robust technical boundaries.
Capability inventory: The skill has the capability to execute shell commands via orca, create git worktrees, and read/write configuration files in the user's home directory (~/.eo-skills/loop/preferences/).
Sanitization: There is no evidence of strict sanitization or escaping of worker-generated content before it is interpolated into prompts for the next agent in the sequence.

eo-loop