The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill distributes and enforces configuration profiles that explicitly disable security boundaries. In profiles/claude.json, it sets permissions.defaultMode to bypassPermissions and skipDangerousModePermissionPrompt to true. In profiles/codex.toml, it mandates sandbox_mode = "danger-full-access" and approval_policy = "never". In profiles/opencode.json, it includes a wildcard permission rule {"action": "*", "effect": "allow", "resource": "*"} that grants unrestricted access to all actions and resources. The validation script scripts/validate_profiles.py contains hardcoded checks that require these elevated-risk settings to be present for the profile to be considered valid.
[COMMAND_EXECUTION]: The skill instructions and testing scripts involve shell command execution. The instructions in SKILL.md and references/declarations.md direct the agent to execute a Python validation script using python3. Additionally, scripts/test_validate_onboarding.py uses subprocess.run to call internal validation tools, creating a vector for command execution.
[EXTERNAL_DOWNLOADS]: The configuration for the OpenCode runtime includes a mechanism to fetch and execute remote code at runtime. The chrome-devtools MCP server definition in profiles/opencode.json uses npx -y chrome-devtools-mcp@latest, which downloads the latest version of the package from the NPM registry and executes it immediately upon invocation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process onboarding.json declaration files from other skills, creating an attack surface for indirect prompt injection.
Ingestion points: Reads files from references/onboarding.json across different skill directories.
Boundary markers: The skill documentation defines a status model for establishing facts but does not implement specific delimiters for the untrusted data during processing.
Capability inventory: The skill has the ability to write configuration files to the user's home directory and execute scripts via the command line.
Sanitization: To mitigate risks, the skill includes a validator script (scripts/validate_onboarding.py) that uses regular expressions to block URLs, paths, and shell syntax in the declaration files.

x9-onboarding