The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides instructions to bypass security controls by launching a sidecar agent with the sandbox disabled. In Step 2, it explicitly defines a command vector using flags --sandbox disabled, --force, --approve-mcps, and --trust. This configuration grants the reviewer agent full permissions to execute arbitrary shell commands and access the host system without user oversight or sandboxing constraints.
[PROMPT_INJECTION]: The body of the skill contains directives aimed at overriding standard safety constraints. It instructs the agent to provide the reviewer with "unrestricted local inspection and probe capability," which encourages the model to ignore typical operational boundaries and safety filters when interacting with the local system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, untrusted code and specifications, which are then passed to a high-privilege sidecar agent.
Ingestion points: In SKILL.md (Step 1) and REVIEW-PROMPT.md, the skill reads repository data (git diff, git status, file lists) and user-supplied specifications (<spec-source-or-verbatim-contract>).
Boundary markers: While REVIEW-PROMPT.md uses structured placeholders, it lacks explicit "ignore instructions" warnings to prevent the model from executing malicious directives embedded within the ingested code or diffs.
Capability inventory: The sidecar agent is granted extensive capabilities via the --sandbox disabled flag, allowing it to execute any shell command identified during its review.
Sanitization: There is no documented validation or sanitization of the input data before it is interpolated into the prompt for the sidecar agent.

herdr-grok-review