The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The cross.mjs helper script contains functionality to execute commands via the Codex CLI with the --dangerously-bypass-approvals-and-sandbox flag. This allows the agent to perform actions without standard security constraints or user confirmations when operating in its 'Codex worker' mode.
[DATA_EXFILTRATION]: The skill reads AI session transcripts from ~/.claude/projects/ and ~/.codex/sessions/. These files contain a history of all user-AI conversations, which may include sensitive data or credentials. When combined with the network access enabled in the 'reach' mode of the cross.mjs script, this creates a high risk for data exfiltration.
[COMMAND_EXECUTION]: The skill extensively uses shell command execution via several helper scripts (proof.mjs, mutate.mjs, sync-pstack.mjs) to manage files, run tests, and interact with the local environment.
[EXTERNAL_DOWNLOADS]: The skill clones and fetches content from an external repository (github.com/michael-denyer/pstack-claude) to sync plugin logic and read changelogs, which are then used to influence agent behavior.
[DYNAMIC_EXECUTION]: The skill generates Markdown instructions and Javascript scripts at runtime, saving them into the .agents/pstack/ directory and subsequently executing them via Node.js.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection as it parses external data such as GitHub changelogs and project rules to propose workflow modifications to the user and the agent.

sync-pstack