The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/relay.mjs utilizes spawn with shell: true on Windows platforms. It passes arguments like --model, --variant, and --session directly to the shell. If the orchestrating agent populates these fields with unvalidated user-controlled strings, it could allow for arbitrary shell command execution via characters like & or |.- [REMOTE_CODE_EXECUTION]: The skill integrates the opencode CLI, a tool provided by the author to autonomously implement code changes in the repository. This facilitates the execution of code generated by remote models within the local environment.- [DATA_EXFILTRATION]: The skill uses the opencode CLI to transmit file content and repository context to external AI model providers (such as OpenRouter) to fulfill implementation requests.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the 'brief' provided to the implementation agent. Malicious instructions in the processed data could influence the agent to perform unintended file modifications.
Ingestion points: Instructions are ingested through the --brief flag or standard input in scripts/relay.mjs.
Boundary markers: The documentation recommends using XML tags for structure, but no mechanical enforcement or validation is present in the code.
Capability inventory: The opencode tool operates with write permissions in the workspace; relay.mjs interacts with the filesystem, git, and system process management tools (taskkill).
Sanitization: No sanitization or input filtering is implemented for the task descriptions or CLI parameters.

opencode-delegate