The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read content from teammates' live sessions, creating a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data from external agents is ingested via tools such as read_relay_conversation, get_shared_session_context, and check_relay_inbox (documented in SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore instructions embedded in the shared session data.
Capability inventory: The agent is granted shell access, allowing it to execute commands (curl, mkdir, install, npx) and write to the file system (~/.codex/skills/).
Sanitization: No sanitization or validation of the remote session content is performed before the agent processes it.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs external packages and other skills during the setup process.
Evidence: It uses npx prpm install to fetch @agent-relay/ packages and npx skills add to fetch skills from github.com/AgentWorkforce/skills.
Note: These resources belong to the skill's author (agentworkforce) or the official service domain (agentrelay.com), representing standard vendor functionality.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for the agent to execute to verify the environment, install software, and configure MCP servers.
Evidence: Shell blocks in SKILL.md include commands for session verification (uname, test -S), file mirroring (mkdir, install, cmp), and MCP management (claude mcp add).

setting-up-agent-relay-sessions