The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a core script scripts/relay.mjs to execute several CLI tools, primarily the MiniMax Code CLI (mcode) and git. These commands are executed via Node's child_process module to perform coding tasks and manage repository state.
[REMOTE_CODE_EXECUTION]: The skill's primary function is to delegate implementation work to an external AI model via the mcode CLI. While the CLI runs locally, its actions (file writes, deletions, and command execution) are determined by a remote AI provider. The skill documentation explicitly warns that this execution is not sandboxed.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because the delegated implementer (mcode) ingests untrusted data from the repository (such as AGENTS.md) and user-provided briefs.
Ingestion points: relay.mjs (brief from stdin or file), mcode (reads repository files and AGENTS.md).
Boundary markers: The skill suggests using XML tags in briefs to structure instructions and provides an advisory "read-only" prompt for review tasks.
Capability inventory: The implementer has full filesystem write and deletion access within the working directory and can execute shell commands as the current user.
Sanitization: The skill does not perform automated sanitization of ingested content, instead relying on a mandatory human review process and a Git status tripwire to detect unintended modifications.
[DYNAMIC_EXECUTION]: The relay.mjs script dynamically constructs shell commands based on user-provided arguments like --mcode-path, --model, and --session. Although it implements regex-based validation for these inputs, this mechanism remains a surface for potential misuse if validation is bypassed.

mcode-delegate