The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a delegation pattern where user-supplied prompts are interpolated directly into shell command strings, such as qwen3 "prompt" and kimi --quiet -p "prompt". This pattern creates an entry point for command injection if the user input contains shell metacharacters.
[CREDENTIALS_UNSAFE]: The documentation instructs the user to store DEEPSEEK_API_KEY and OPENAI_API_KEY directly within the ~/.zshrc shell profile.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user prompts through an initial classification stage (qwen3) which determines the command to be executed in the subsequent step.
Ingestion points: User prompts received through the UserPromptSubmit hook (SKILL.md).
Boundary markers: None identified in the routing flow to isolate prompt data from instructions.
Capability inventory: The skill facilitates shell command execution and network operations via curl (SKILL.md).
Sanitization: While the bash template uses jq --arg for output construction, the primary routing logic shown in the examples lacks evidence of shell-safe escaping for the initial command invocation.
[DATA_EXFILTRATION]: User prompts are sent to external services including DeepSeek, Kimi, and OpenAI via network requests initiated by delegation scripts using curl and third-party CLI binaries.

external-model-delegation