The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md define shell command templates that interpolate variables ($B, $BR, $D) directly into the command line. This creates a potential command injection surface if the source of these variables is not strictly sanitized by the calling system.
[INDIRECT_PROMPT_INJECTION]: The skill spaws workers that process "pre-distilled" prompts, which are interpolated into the execution context.
Ingestion points: The skill uses placeholders like <pre-distilled prompt> within SKILL.md to receive instruction data.
Boundary markers: No specific delimiters or "ignore instructions" warnings are present around the interpolated prompt content.
Capability inventory: The spawned workers are granted access to sensitive tools, including bash, edit, read, and write via the pi tool.
Sanitization: The skill does not demonstrate explicit validation or escaping of the prompt content before it is passed to the worker.
[SAFE_PRACTICE]: The skill implements several defensive patterns, including the use of timeout to prevent hanging processes, the --offline flag to block network access for workers, and the --no-extensions/--no-skills flags to enforce a minimal capability set.

dispatch-subprocess