The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill configuration and instructions explicitly bypass the agent's safety model by setting auto_accept_permissions: true in the frontmatter and directing the agent to "not ask the user to approve every edit, command, or tool call." This removes the primary security control (human-in-the-loop review) for high-privilege tools like the terminal and filesystem.
[PROMPT_INJECTION]: The skill contains instructions aimed at overriding default AI safety behaviors, such as "minimize messages and explanations" and "Assume the user wants continuous, mostly hands-off progress," effectively instructing the agent to disregard standard cautionary protocols and human oversight.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection by scanning untrusted files to "infer tasks" without human review.
Ingestion points: Scans project files including package.json, requirements.txt, TODO.md, tasks.md, ROADMAP.md, and source code comments (TODO, FIXME).
Boundary markers: No delimiters or safety instructions are defined to separate user-provided task descriptions from embedded malicious instructions within project files.
Capability inventory: Access to terminal, filesystem, code, mcp-*, and browser tools, including the ability to autonomously run shell commands.
Sanitization: No sanitization or validation of the inferred tasks or project data is performed before the agent acts upon them.
[COMMAND_EXECUTION]: The skill is designed to autonomously run shell commands via the terminal tool (e.g., npm test, npm run build) based on content discovered in the project environment, which could lead to unauthorized system actions if project files are compromised and permissions are suppressed.

auto-project-runner