The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/tdel bash script is vulnerable to shell command injection. In the start command handler, the agent_cmd variable is expanded without double quotes ($agent_cmd) when passed to tmux new-session. This allows an attacker who can influence the skill's arguments to execute arbitrary shell commands on the host system outside of the intended agent command.
[PROMPT_INJECTION]: The skill instructions and harness reference explicitly direct the agent to use safety-bypass flags for delegated subagents, such as claude --dangerously-skip-permissions and codex --dangerously-bypass-approvals-and-sandbox. This instructs the AI to intentionally circumvent the security guardrails and permission prompts designed to protect the user's environment.
[COMMAND_EXECUTION]: The tdel script includes logic to actively bypass security shims for the tmux binary. It iterates through the system PATH to find a binary that is not a shell script, specifically to avoid 'harness-managed' or whitelisted command wrappers, which could be used for security auditing or restriction.
[PROMPT_INJECTION]: The skill creates an attack surface for Indirect Prompt Injection. It reads summary files generated by external subagent processes (which may be processing untrusted data) and injects their content directly into the main agent's context.
Ingestion points: The tdel wait and tdel result commands read turn summary files from /tmp/agent-delegate/.
Boundary markers: Uses a simple --- summary --- text header which can be easily spoofed or bypassed.
Capability inventory: The skill allows execution of arbitrary commands via tmux and provides low-level keyboard input capabilities (tdel key).
Sanitization: The script performs no sanitization or escaping of the summary file content before it is displayed to and processed by the coordinator agent.

open-agent-teams