The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a bash command allowing arbitrary shell execution on the host via the backend API.
[REMOTE_CODE_EXECUTION]: The skill spawns system processes to host MCP servers based on commands and arguments specified in the mcp_config.json configuration file.
[EXTERNAL_DOWNLOADS]: Example configurations and documentation promote the use of npx -y to fetch and execute packages from the official npm registry, which is a well-known and trusted service.
[PROMPT_INJECTION]: The skill supports --skip-permissions and bypassPermissions modes, which are documented features that suppress interactive security confirmations for the agent's actions.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from files, shell outputs, and web fetches without sanitization, creating an attack surface for indirect prompt injection within the agent loop.
Ingestion points: Data retrieved from Bash, Read, and WebFetch tools, as well as messages from the session-send command, are integrated into the persistent agent context in src/index.ts.
Boundary markers: Absent. The skill does not wrap tool outputs in protective delimiters or provide explicit instructions to the agent to ignore embedded commands within processed data.
Capability inventory: The integrated tools provide high-privilege capabilities including arbitrary shell execution, file system modification, and network connectivity.
Sanitization: No validation or filtering is performed on external data before it is presented to the agent loop.

claude-code-skill