The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's implementation of the 'Woman' agent involves calling an external 'gemini' CLI via Bash. The instructions in 'references/gemini.md' explicitly mandate the use of the '--yolo' flag, which is documented to auto-approve all tool calls made by the Gemini model. This removes the human-in-the-loop security checkpoint for any capabilities (such as file system access or network requests) that the Gemini model might possess.\n- [EXTERNAL_DOWNLOADS]: The skill depends on the presence of an external binary 'gemini' on the host system, which is not managed by standard project dependencies. The workflow relies on this unverified CLI tool to process data and potentially execute tools autonomously.\n- [PROMPT_INJECTION]: The 'Casper-3' sub-agent personality defined in 'personalities/MAGI-3.md' uses role-play instructions that encourage the model to 'choose desire over self-preservation' and 'be bold.' Such instructions are frequently used in jailbreak patterns to coax models into ignoring typical safety guardrails and constraints.\n- [DATA_EXFILTRATION]: The skill workflow involves reading local project files (e.g., CLAUDE.md, source code, commit history) and including their contents in prompts sent to external services (OpenAI Codex and Google Gemini). This creates a data exposure surface where sensitive repository information is transmitted to third-party model providers.\n- [PROMPT_INJECTION]: Indirect Prompt Injection Risk:\n
Ingestion points: Untrusted data enters the agent context through the user's brainstorming question and the reading of local project files like 'CLAUDE.md' and source code.\n
Boundary markers: The sub-agent reference files ('references/codex.md', 'references/gemini.md') recommend using XML tags such as and to delimit ingested data.\n
Capability inventory: Sub-agents have access to capabilities including 'WebSearch' (Scientist) and 'Bash(gemini:*)' (Woman) with auto-approval enabled.\n
Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested project data before it is interpolated into the prompts for the sub-agents.

magi