The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly references and accesses sensitive credential files located at ~/.qwen/oauth_creds.json. While documented as a mechanism to check OAuth expiry dates and avoid failed execution, this path contains active session tokens for the user's Alibaba/Qwen account.
[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the @qwen-code/qwen-code package via NPM. This is a legitimate and official package from the Qwen Team at Alibaba, used for CLI-based code interaction.
[INDIRECT_PROMPT_INJECTION]: The skill provides a significant attack surface for indirect prompt injection as its primary purpose is to process file contents (via --files or @path arguments) and include them in the LLM prompt context.
Ingestion points: Ingestion occurs through the delegation_executor.py script's --files flag and the qwen CLI's @path pattern in SKILL.md and modules/qwen-specifics.md.
Boundary markers: The instructions do not specify the use of clear delimiters or XML-style tagging to separate untrusted file content from system instructions.
Capability inventory: The skill utilizes shell command execution (qwen CLI, uv run python) and has the capability to read local files (both task-related files and configuration/credential files).
Sanitization: No explicit sanitization or filtering of external file content is described in the prompt construction logic.
[COMMAND_EXECUTION]: The skill relies on executing shell commands, including qwen and uv run python scripts/delegation_executor.py, to perform its delegation tasks.

qwen-delegation