The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to use the agent CLI with the --yolo and --trust flags. These flags are intended to suppress user oversight and safety confirmations, enabling the automatic execution of commands.
[REMOTE_CODE_EXECUTION]: The skill instructions state that the delegating model may choose 'unrestricted execution' by disabling the sandbox and auto-approving MCP tools (e.g., --sandbox disabled --approve-mcps). This removes the primary security boundary between the AI model and the host operating system, allowing it to perform any file or system operation.
[INDIRECT_PROMPT_INJECTION]: The skill creates a high-capability execution pipeline that processes input from a workspace file ($prompt_file) without sanitization or boundary markers. This exposes the system to indirect injection attacks where malicious content in a repository could hijack the sub-agent's elevated permissions.
Ingestion points: Content is read from a file within the project workspace.
Boundary markers: None are provided to prevent the sub-agent from following instructions embedded in the file content.
Capability inventory: The sub-agent is granted full access to the workspace and the host shell through the CLI.
Sanitization: No validation or filtering is performed on the prompt file before it is executed.

grok-worker