The Agent Skills Directory

[COMMAND_EXECUTION]: The relay.mjs script uses the node:child_process module to execute claude and git commands. The implementation employs several defensive measures to mitigate command injection risks:
It validates command-line arguments such as model names and session IDs using strict regular expressions and length checks.
For Windows environments, it uses a custom quoteCmdArgument function that actively rejects characters like %, !, and internal quotes that could be exploited to escape shell boundaries in cmd.exe launches.
The task content ("brief") is delivered to the child process via stdin, ensuring it is never processed as a shell argument.
[INDIRECT_PROMPT_INJECTION]: As a delegation tool, the skill is designed to ingest and process "briefs"—natural language instructions that are passed to a child agent with capabilities to read, edit, and execute code in the workspace. This creates a surface where malicious content within a processed repository could influence the child agent's behavior. The skill provides extensive mitigation guidance, including mandatory human review of diffs and the use of XML-based boundary markers to isolate instructions.
[DYNAMIC_EXECUTION]: The relay script dynamically generates a profile.json configuration file at runtime to control the child Claude process. This profile is used to enforce security policies, such as denying specific git subcommands (commit/push) and enabling filesystem isolation through Claude's internal shell sandbox on supported platforms.

claude-delegate