The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a spawn_worker_process function in SKILL.md that executes the codex exec command with the --dangerously-bypass-approvals-and-sandbox flag. This explicitly disables all security protections and human-in-the-loop approvals, allowing the spawned agent to execute arbitrary shell commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through GitHub issue comments.
Ingestion points: The spawn_replacement_worker function uses gh api to fetch issue comments containing a specific marker.
Boundary markers: None. The fetched content is interpolated directly into the construct_worker_prompt template without delimiters or safety instructions.
Capability inventory: The spawned worker is granted the Bash tool and operates without a sandbox, providing a direct execution path for any injected instructions.
Sanitization: The skill performs no filtering or escaping of the external content before processing it as instructions.
[PRIVILEGE_ESCALATION]: The use of the --dangerously-bypass-approvals-and-sandbox flag represents a deliberate privilege escalation by bypassing the platform's default security architecture. This allows the AI agent to perform actions that would otherwise be restricted by the sandbox environments.
[COMMAND_EXECUTION]: The skill uses background shell execution (the & operator) and PID tracking to manage unsanboxed worker processes, increasing the risk of orphaned processes and uncontrolled system resource usage.

worker-dispatch