The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary purpose is to launch arbitrary executables in a new host terminal window using child_process.spawn. It implements security best practices by explicitly setting shell: false to prevent shell injection and includes validation logic in scripts/open-terminal.js to ensure arguments do not contain NUL bytes or control characters.
[DATA_EXFILTRATION]: As documented in SKILL.md, any process launched via this utility inherits the environment variables of the calling agent process. The documentation transparently warns that this includes secret-bearing variables and advises users to run the launcher from a safe environment.
[PROMPT_INJECTION]: The instructions in SKILL.md reinforce safe behavior by instructing the agent to never interpolate shell command strings and to review the execution plan before using the --launch flag.

terminal-opener