The Agent Skills Directory

[COMMAND_EXECUTION]: The skill manages worker processes using subprocess.Popen and os.fork (on POSIX) or DETACHED_PROCESS (on Windows) to facilitate asynchronous cross-model evaluations. These calls use argument lists rather than shell strings, mitigating command injection risks.
[EXTERNAL_DOWNLOADS]: The scripts/cross-model-pov.sh script utilizes npx to fetch and execute the acpx (Agent Client Protocol) adapter at a pinned version (0.19.4) to enable communication between different AI models.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from web searches (via the researcher scout) and local project files. It mitigates this risk by using structured JSON schemas for subagent communication and including explicit instructions in subagent personas to treat input as data rather than instructions.
[DYNAMIC_EXECUTION]: The scripts/peer-job-runner.py utility implements a detached supervision lifecycle for delegated tasks, involving process detachment and monitoring. The script includes robust security checks, such as verifying file descriptors against the effective user ID and using O_NOFOLLOW to prevent symlink attacks.

ce-pov