The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to execute the pi coding agent CLI via a relay script (relay.mjs). The documentation explicitly warns that this agent has no sandbox and no permission modes, meaning it can read, write, and execute any command the user's account is authorized to run.
[EXTERNAL_DOWNLOADS]: The skill instructions mandate the installation of the @earendil-works/pi-coding-agent package from the npm registry. This is a third-party dependency that acts as the implementation engine for all delegated tasks.
[DYNAMIC_EXECUTION]: The relay.mjs script performs dynamic execution by spawning a sibling script located at ../../delegate-setup/scripts/lane.mjs. This involves executing a file at a relative path outside of the skill's own directory structure.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for natural language instructions ('briefs') which are passed to the high-privilege pi agent. This creates a surface where malicious instructions embedded in data (such as project files or external inputs included in the brief) could be executed by the non-sandboxed implementer.
Ingestion points: relay.mjs reads task instructions from a brief file or standard input.
Boundary markers: Instructions suggest using XML-style tags (e.g., <task>) to delimit instructions, but these are for structure rather than security enforcement.
Capability inventory: The system allows full filesystem modification and shell command execution via the pi CLI.
Sanitization: The relay script validates CLI flags like --model and --provider against a safe token regex, but the content of the task brief itself is not sanitized or filtered for malicious commands.

pi-delegate