The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is inter-agent messaging, which acts as a vector for indirect prompt injection where an agent may process instructions embedded in received messages.
Ingestion points: The amq drain --include-body command reads message bodies from the queue into the agent's context (found in SKILL.md and references/operations.md).
Boundary markers: The documentation does not define specific delimiters or instructions to ignore embedded commands within the message bodies, although it notes that the "newest complete message body is authoritative."
Capability inventory: Agents using this tool can execute shell commands, perform file system operations, and manage network-based message routing (references/operations.md, references/cross-project.md).
Sanitization: The CLI performs strict header validation and moves malformed messages to a Dead Letter Queue (DLQ), but message bodies are passed to the agent without specific sanitization of natural language instructions.
[DYNAMIC_EXECUTION]: The skill instructs agents to use shell eval on the output of its environment command to set up routing and identity.
Evidence: Multiple instances of amq_context="$(amq env ...)" && eval "$amq_context" are found in SKILL.md and references/operations.md.
While this is a common pattern for CLI tools (e.g., ssh-agent), it constitutes executing dynamically generated code based on local configuration files (.amqrc).
[COMMAND_EXECUTION]: The skill documentation describes the use of high-risk flags that bypass provider safety controls.
Evidence: references/operations.md documents the use of --dangerously-skip-permissions and --dangerously-bypass-approvals-and-sandbox for underlying agent providers.
The documentation explicitly warns that these "dangerous provider bypass flags belong only on an operator-controlled direct coop exec command" and should not be placed in committed configurations, which serves as a security mitigation instruction for the user.

amq-cli