The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/relay.mjs script executes the claude CLI and git as subprocesses using Node.js built-ins.
Evidence: The script uses spawn and execFileSync to launch the claude binary and perform git operations in scripts/relay.mjs.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy, taking an unvalidated task description ("brief") and passing it to a powerful child agent with shell and filesystem access.
Ingestion points: The readBrief function in scripts/relay.mjs reads the brief from a file or stdin, which is then used in the dispatch function.
Boundary markers: The skill suggests using XML-style tags in references/writing-the-brief.md to structure the brief, but the scripts/relay.mjs script does not programmatically enforce or validate these boundaries.
Capability inventory: The toolSurface function in scripts/relay.mjs defines a toolset including Read,Glob,Grep,Edit,Write,Bash, and PowerShell for the child agent.
Sanitization: Absent; the dispatch function in scripts/relay.mjs pipes the raw, unescaped brief text directly to the child agent's stdin.
[DYNAMIC_EXECUTION]: The script dynamically resolves the path to the claude executable by searching the system PATH and builds the command-line arguments at runtime.
Evidence: Logic in the resolveClaudeLauncher and launchSpec functions in scripts/relay.mjs.
[PRIVILEGE_ESCALATION]: The documentation suggests that users may need to run the delegation with escalated sandbox permissions to bypass security restrictions on credential access.
Evidence: The "Prerequisites" section of SKILL.md advises running the dispatch "with that sandbox escalated or outside it" if keychain access is blocked.

claude-delegate