The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit instructions for the agent to execute various shell scripts located in ~/bin/ (e.g., qwen3, gemini, deepseek, kimi). These scripts are used to delegate tasks to different AI backends.
[INDIRECT_PROMPT_INJECTION]: The delegation commands (e.g., ~/bin/qwen3 "prompt") interpolate the user's raw prompt directly into a shell command. An attacker could craft a prompt containing shell metacharacters (such as ;, &&, or $()) to bypass the intended script and execute arbitrary commands on the host system.
[PERSISTENCE]: The skill relies on a UserPromptSubmit hook located at ~/.claude/hooks/route-task-hook. This mechanism ensures that the routing logic and associated scripts are executed automatically every time a user submits a prompt, which can be used to maintain persistent control or monitoring of agent activity.
[DATA_EXPOSURE]: The skill interacts with sensitive configuration files and environment variables, specifically targeting ~/.zshrc to access DEEPSEEK_API_KEY, GEMINI_API_KEY, and OPENAI_API_KEY. It also reads and writes to several log and cache files in ~/.claude/, which could contain history or metadata about the user's prompts and system state.
[INDIRECT_PROMPT_INJECTION]: Evidence Chain:
Ingestion points: User prompts are processed by the pipeline described in SKILL.md.
Boundary markers: None identified. The prompt is passed as a bare string argument to shell scripts.
Capability inventory: The skill uses subprocess calls via bash to execute ~/bin/ scripts, cat for file access, and grep for searching.
Sanitization: No evidence of input escaping or sanitization is provided in the instructions, leaving the shell execution vulnerable.

model-routing