The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains a shell command within the !command`` syntax that executes automatically when the skill is loaded by the agent. This command attempts to execute skill-toc or a script from a local directory to generate a table of contents.
Evidence: !d=${CLAUDE_SKILL_DIR}; command -v skill-toc >/dev/null 2>&1 && exec skill-toc "$d"; s=$HOME/.claude/skills/plugin-utils/bin/skill-toc; [ -x "$s" ] && exec "$s" "$d"; echo "(skill-toc unavailable: references and scripts are NOT listed here — install the plugin-utils plugin, or start a new session so its bin/ reaches PATH)"``
[DATA_EXFILTRATION]: The script scripts/bgjobs.py performs system-level inspection by reading from the /proc filesystem. Specifically, it reads the environment variables of other processes to identify tasks associated with a specific row ID. This behavior exposes potentially sensitive environment data to the skill's logic.
Evidence: In scripts/bgjobs.py, the procs() function iterates through /proc and opens /proc/{d}/stat, /proc/{d}/cmdline, and /proc/{d}/environ to extract FARM_ROW_ID and other process metadata.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command execution and subprocess management to orchestrate sub-agents and monitor their resources.
Evidence:
scripts/farm.sh and scripts/farm-team.sh use shell wrappers (claude-code, codex-code, gemini-code) with the -p flag to launch new agent sessions.
scripts/watchdog.py uses subprocess.run(["ps", "-o", "stat=", "-p", str(pid)], ...) to check the status of child processes.
scripts/farm.sh uses setsid nohup to detach long-running tasks.
[INDIRECT_PROMPT_INJECTION]: The skill provides an orchestration layer that ingests external data (task prompts) and interpolates them into instructions for downstream agents, creating a surface for indirect injection attacks.
Ingestion points: scripts/farm.sh reads task prompts from a JSON file provided via the --tasks argument.
Boundary markers: The script appends hardcoded "anti-simulation" and "child standing" instructions to the prompts to guide sub-agent behavior, but these are not cryptographic or structural boundaries.
Capability inventory: Spawns sub-agents that typically have access to Bash, Edit, Write, and Workflow tools, allowing for significant system impact.
Sanitization: The skill employs an artifact verification mechanism (--expect) that checks for the existence and non-zero size of expected output files, which serves as a basic validation of work performed.

farm-out