The Agent Skills Directory

[COMMAND_EXECUTION]: The skill launches the claude CLI in a non-interactive mode (-p) to perform tasks involving shell command execution and file system modifications. This is the skill's primary function, managed through environment variable injection and process isolation using git worktrees to limit the potential blast radius of automated edits.
[INDIRECT_PROMPT_INJECTION]: The worker agents ingest user-provided tasks that may contain data from external files, creating a surface for indirect prompt injection. The skill mitigates this by relying on an Opus-level orchestrator for result verification and a merge gate (fleet-ops) to review all modifications before they reach the main branch.
Ingestion points: Prompts provided to scripts/fleet-worker via command-line arguments or standard input.
Boundary markers: The launcher does not implement explicit boundary markers or safety delimiters for the sub-agent prompts.
Capability inventory: The sub-agents have access to the full claude tool harness, including Bash, Edit, Read, and Write capabilities.
Sanitization: No input validation or prompt sanitization is performed by the launcher scripts.
[EXTERNAL_DOWNLOADS]: The scripts/fleet-doctor.sh script uses curl to perform a diagnostic connectivity check by sending an HTTP POST request to the configured API endpoint (e.g., api.z.ai). This request includes the user's API key in the headers to verify authentication status.
[DYNAMIC_EXECUTION]: The self-test suite (tests/run.sh) dynamically generates mock shell scripts in a temporary directory and modifies the system PATH to execute them, verifying the launcher's environment handling and credential resolution logic.
[DATA_EXFILTRATION]: The scripts/fleet-doctor.sh diagnostic utility reads the host's ~/.claude.json configuration file. This is intended to identify and warn the user about existing OAuth sessions that would conflict with the skill's custom API authentication mechanism.

fleet-worker