The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides explicit instructions for the agent to access private SSH keys located in the ~/.ssh/ directory. Evidence includes the command pattern ssh -i ~/.ssh/<key> <user>@<tailscale-ip> used to connect to remote model hosts.
[REMOTE_CODE_EXECUTION]: The orchestration strategy includes paths for the agent to execute code on remote servers via SSH, as well as running local scripts from internal cache directories, such as node "~/.claude/plugins/cache/openai-codex/codex/1.0.4/scripts/codex-companion.mjs".
[COMMAND_EXECUTION]: The skill frequently directs the agent to use shell-based tools including curl, ssh, and node to delegate tasks to external models and APIs.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: User-supplied prompts enter the system as variables passed to external CLI tools and remote API calls.
Boundary markers: The documentation lacks any delimiters (like XML tags or triple quotes) to wrap user input, increasing the risk that embedded instructions could be obeyed.
Capability inventory: The skill possesses high-privilege capabilities including file system access, network requests via curl, and remote command execution via ssh.
Sanitization: There is no instruction for the agent to sanitize, escape, or validate user-provided strings before they are interpolated into command-line arguments (e.g., companion-for-agy "research prompt").

model-strategy