The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest codebase files and user-provided context to process them through external LLMs. This creates a surface where malicious instructions embedded in the analyzed files could attempt to influence the agent's plan or the behavior of the delegated models.
Ingestion points: Local files and context buffers passed to the execute and smart_delegate functions in scripts/delegation_executor.py.
Boundary markers: The framework documents truncation warnings (e.g., [context truncated at ... bytes]), but the provided instructions do not explicitly describe the use of XML tags or specific delimiters to isolate untrusted content from the agent's instructions.
Capability inventory: The skill is capable of executing various external CLIs (Gemini, Codex, etc.) and performing network requests to LLM endpoints.
Sanitization: Implements logic to escape prompts starting with dashes to prevent flag injection into the underlying CLI tools.
[COMMAND_EXECUTION]: The framework is designed to spawn and interact with external CLI binaries including gemini, qwen, mmx, claude, muse, codex, opencode, and ollama. It manages complex argument construction, environment variable overlays for credentials, and stdin delivery for large contexts.
[DATA_EXFILTRATION]: As an execution delegation tool, the skill transmits local project data and file content to external LLM providers. While it includes 'Keep Local' guidelines specifically for secrets, credentials, and security-sensitive code, the technical capability to send local file content to remote well-known services is a core feature of the framework.

delegation-core