The Agent Skills Directory

[COMMAND_EXECUTION]: Explicitly instructs the agent to use high-risk execution modes such as --yolo (for Codex) and --dangerously-skip-permissions (for Claude Code). These flags are designed to execute commands without user confirmation or sandboxing, which significantly increases the risk of destructive actions.
[PRIVILEGE_ESCALATION]: Recommends bypassing application-level safety mechanisms by using flags like --permission-mode bypassPermissions and --yolo. This encourages the agent to operate with full autonomy and without the oversight typically enforced by the tools' default security policies.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to install third-party software from unknown or unverifiable maintainers, such as the @mariozechner/pi-coding-agent package via npm, introducing potential supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a significant vulnerability surface where it ingests untrusted data from external sources (e.g., pull requests via git clone or gh pr checkout) and processes it using high-privilege tools like exec_command. Malicious instructions embedded in a pull request could hijack the sub-agent to perform unauthorized file edits, data exfiltration, or further command execution.
Ingestion points: External code repositories and pull requests (SKILL.md).
Boundary markers: No specific boundary markers or instruction-ignoring delimiters are defined for the sub-agent task prompts.
Capability inventory: Full shell command execution (exec_command), background process management (process), and file system manipulation.
Sanitization: None. While the skill recommends using temporary directories (mktemp) to isolate the workspace, it does not sanitize the content of the data being processed by the agent.

sub-agent