The Agent Skills Directory

[COMMAND_EXECUTION]: The relay.mjs script executes the grok and git CLI tools to dispatch coding tasks and monitor repository status. The script implements strict input validation, using a whitelist-based regular expression (safeToken) for command-line arguments like session IDs and model names to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill requires the grok CLI, which it instructs the user to install via official xAI package channels (npm i -g @xai-official/grok).
[DATA_EXFILTRATION]: The skill transmits project context and task instructions (the "brief") to xAI's Grok API via the local grok CLI. This is the intended and documented primary function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests and processes output from an external implementer (Grok). To mitigate the risk of malicious or incorrect output, the skill documentation (e.g., references/review-and-land.md) provides an extensive checklist for manual diff review, gate re-verification, and dependency validation.
Ingestion points: The relay.mjs script captures the stdout and stderr streams of the grok process to extract events and final messages.
Boundary markers: The skill uses XML-tagged structures in its task briefs to define scope and includes explicit instructions for the agent to re-run project gates manually.
Capability inventory: The skill uses child_process.spawn and execFileSync to interface with system tools.
Sanitization: relay.mjs uses a brace-aware JSON scanner and standard JSON.parse to extract structured data from the implementer's stream.

grok-delegate