The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python bridge script (scripts/trvl-codex-bridge.py) that uses subprocess.Popen to execute a local binary (/opt/homebrew/bin/trvl). This execution uses a hardcoded path and arguments without shell invocation or unsanitized user input, acting as a transparent proxy to filter flight result metadata for platform compatibility.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external flight search providers (trvl and octotrip-flights). To mitigate risks associated with processing external content, the instructions require the agent to validate and normalize route information (IATA codes) before tool invocation. The provided bridge script also performs automated sanitization by stripping potentially problematic metadata fields from the provider's JSON responses before they are processed by the agent.

flight-search