The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a relay script relay.mjs that executes external binaries such as zcode and git using node:child_process. While the script implements input validation using regular expressions for session IDs and tool denylists, and resolves paths for the CLI dynamically, the execution of external tools is central to its operation.
[PROMPT_INJECTION]: The skill acts as a bridge for delegating tasks to a secondary agent, making it a surface for indirect prompt injection. A malicious 'brief' provided as input could contain instructions designed to manipulate the implementer's behavior. The skill includes instructions for the orchestrator to perform human review of all changes and re-run project gates to mitigate this risk. Evidence chain: (1) Ingestion points: Natural language briefs read from files or stdin. (2) Boundary markers: Structured markdown headers and explicit 'do not commit' instructions are used to frame the implementer's task. (3) Capability inventory: The skill can spawn subprocesses and modify local files. (4) Sanitization: The relay script validates specific shell-facing arguments against allowed character sets.
[CREDENTIALS_UNSAFE]: The skill is documented to use API keys (ZAI_API_KEY, ZCODE_API_KEY, ANTHROPIC_API_KEY) provided through environment variables. While this is standard practice for CLI applications, the relay script passes its full environment to the implementer CLI, which increases the exposure of potentially sensitive environment variables to the implementer tool.

zcode-delegate