The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's relay script (scripts/relay.mjs) executes external binaries including the omp CLI, git (for status reporting), and the system taskkill utility on Windows. It uses the node:child_process module to spawn these processes.
[EXTERNAL_DOWNLOADS]: The documentation (SKILL.md) directs users to install the @oh-my-pi/pi-coding-agent package via bun or from https://omp.sh. This package and domain originate from a third-party source not identified as a trusted vendor or well-known service, presenting a supply-chain risk.
[DYNAMIC_EXECUTION]: If the --lane flag is utilized, the relay script dynamically resolves and executes a Node.js script located at a relative path (../../delegate-setup/scripts/lane.mjs). This creates a functional dependency on external code residing outside the skill's directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes task 'briefs' and workspace files, creating a surface for indirect prompt injection attacks where malicious data could influence the implementer's behavior.
Ingestion points: Task briefs provided via stdin or file to relay.mjs; workspace file content read by the omp implementer.
Boundary markers: The documentation recommends using XML-style tags (e.g., <task>, <action_safety>) within briefs to structure instructions.
Capability inventory: The spawned omp process has broad permissions to read and write files in the local workspace and can execute shell commands via its own internal tools.
Sanitization: The relay script implements token validation using a regular expression (SAFE_TOKEN) for specific command-line arguments to prevent flag injection, though the main task brief is passed through without sanitization.

omp-delegate