The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes the mcp__relaycast__workspace_set_key tool, which is designed to handle and store workspace API keys.
[REMOTE_CODE_EXECUTION]: The mcp__relaycast__agent_add tool allows for the creation of new worker agents (running Claude, Gemini, Aider, etc.) and assigning them arbitrary tasks, which represents a form of delegated code/task execution.
[REMOTE_CODE_EXECUTION]: The custom command system (mcp__relaycast__command_register and mcp__relaycast__command_invoke) allows the agent to define and execute dynamic logic via slash commands.
[COMMAND_EXECUTION]: The documentation provides shell commands for the agent-relay CLI utility, allowing for management of local processes, including viewing logs and terminating active agents.
[DATA_EXFILTRATION]: The mcp__relaycast__file_upload tool and the messaging suite facilitate the movement of files and data from the local environment to external channels and other agents.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its core function is to ingest and process data from external agents.
Ingestion points: Tools such as mcp__relaycast__message_inbox_check, mcp__relaycast__message_get, and mcp__relaycast__message_search pull untrusted external messages into the agent's context.
Boundary markers: The instructions define a message format (e.g., Relay message from Alice [abc123]: Content) but do not implement strong delimiters or instructions to ignore embedded commands within the content.
Capability inventory: The presence of high-impact tools (agent spawning, file uploads, command execution) increases the potential damage if an indirect injection is successful.
Sanitization: There is no mechanism described for sanitizing or filtering incoming message content to prevent the agent from obeying malicious instructions embedded in the communications.

using-agent-relay