The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a delegation pattern where user-provided prompts are interpolated directly into shell commands (e.g., ~/bin/qwen3 "prompt", ~/bin/kimi --quiet -p "prompt"). If the prompt contains shell metacharacters such as backticks, semicolons, or dollar signs, it could lead to arbitrary command execution on the host system.
[DYNAMIC_EXECUTION]: The Tier 7 routing logic utilizes a codex exec "prompt" command. This suggests the system is designed to execute code generated or contained within the user prompt, creating a high-risk surface for arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The multi-tier routing pipeline relies on outputs from intermediary classifiers (Qwen3, Kimi, DeepSeek) to determine subsequent agent actions. Maliciously crafted data could manipulate these classifiers to bypass intended logic or force the use of specific model tiers.
- Ingestion points: Untrusted user input enters the system via the UserPromptSubmit hook and is processed by the ~/bin/route-task script.
- Boundary markers: The documentation does not specify any delimiters or instructions to ignore embedded commands within the prompt.
- Capability inventory: The system has access to the local shell, binary execution (Kimi, Codex), and network requests via Python's httpx library.
- Sanitization: There is no evidence of sanitization, escaping, or validation of the prompt string before it is passed to shell scripts.

model-routing