The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bundled Node.js script, write-operator-permissions.mjs, to apply security hardening rules to the agent's configuration (Phase 3.6). This script manages a set-union of deny rules for sensitive file paths and dangerous commands. The execution is gated by multiple safety layers: it performs a --dry-run to show proposed changes, requires explicit user confirmation via AskUserQuestion, and automatically creates backups with a provided rollback command.
[SAFE]: The deterministic scanner's detection of a 'fork bomb' in references/operator-permissions.json is a false positive. The string occurs only within documentation and changelog metadata fields, explaining that the specific pattern was removed from the active configuration because the platform's parser does not support the syntax. It is not present in any executable path or the active deny list.
[SAFE]: The skill implements extensive security and privacy rules. For example, telemetry-consent-gate.md ensures that telemetry is disabled by default and requires informed opt-in, while existing-config-preservation.md prevents the automated overwriting of existing project instructions (CLAUDE.md) or custom rules.
[SAFE]: Data collection for telemetry is strictly controlled. The wizard requires the user to provide their own webhook URL and explicitly confirms that no file contents, prompts, or code snippets are included in the session metadata streams.

setup