The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module in scripts/castmate.py to execute external AI CLI binaries (e.g., claude, codex, gemini, agy). It correctly implements list-based argument passing instead of shell strings, which prevents shell command injection. Additionally, it implements an environment variable denylist (e.g., LD_PRELOAD, PYTHONPATH, BASH_ENV) in the safe_env function to prevent the leakage of sensitive system variables to the subprocesses.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest project files and git diffs and pass them to other AI models. This creates a surface for indirect prompt injection where malicious code in a processed repository could attempt to subvert the instructions of the host or castmate agents.
Ingestion points: Local files and git diffs are read in SKILL.md (Step 3) and passed into templates in references/prompt-template.md.
Boundary markers: The skill uses Markdown headers (e.g., # Task, ## Scope) to delimit instructions from data, but does not employ strict escaping or XML-style tagging for untrusted content.
Capability inventory: The scripts/castmate.py script can execute arbitrary local binaries and write model outputs to the filesystem.
Sanitization: No explicit sanitization or filtering is applied to the code content before it is interpolated into the prompts.
[EXTERNAL_DOWNLOADS]: Documentation in references/cli-setup.md provides shell commands for installing official AI CLI tools. These downloads are hosted on trusted or well-known service domains, including claude.ai (Anthropic), google.com (Google), and the official npmjs.com registry for Codex and Gemini packages.

castmate