The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to circumvent platform security boundaries when encountering denials.
Evidence: In SKILL.md under the "Sandbox Denials" section, the agent is instructed: "When a command failed on a sandbox denial... re-run it via the Bash tool (dangerouslyDisableSandbox: true) before treating the infrastructure as unavailable."
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and logs without sanitization, creating a vulnerability surface.
Ingestion points: The agent is told to tail application logs for errors using the Monitor tool and read file contents at specific git references (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or warnings to ignore instructions that might be embedded in logs or code files.
Capability inventory: The skill utilizes the Bash tool (with potential sandbox bypass), browser session management, tmux control, and arbitrary file system writes for scratchpads (SKILL.md).
Sanitization: Absent. There are no requirements to escape, filter, or validate the content of the logs or git output before the agent acts upon the information.
[COMMAND_EXECUTION]: The skill requires extensive interaction with the host system via shell commands, which increases the impact of other vulnerabilities.
Evidence: Instructions for managing tmux sessions, binding unique ports, capturing PIDs, and terminating entire process groups via the Bash tool.

test-run-rules