The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a bash tool to execute arbitrary shell commands, specifying parameters like elevated:true which allow execution on the host system instead of a sandbox.\n- [EXTERNAL_DOWNLOADS]: The instructions suggest installing third-party tools such as @mariozechner/pi-coding-agent via npm install -g, which executes unverified code during the installation process.\n- [REMOTE_CODE_EXECUTION]: The skill facilitates the use of external coding agents (Codex, Claude Code, etc.) that operate autonomously on the local filesystem and execute code to perform tasks.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by instructing agents to process code from external pull requests and repositories. Ingestion points: git clone and gh pr checkout in SKILL.md. Boundary markers: Absent. Capability inventory: bash and process tools with host-level permissions. Sanitization: Absent.\n- [DATA_EXFILTRATION]: The process tool allows reading process logs (action:log) and writing to stdin (action:write). While documentation advises against sending secrets, the technical capability to intercept process output is present.\n- [PROMPT_INJECTION]: The SAFETY.md file contains self-authoritative claims regarding the skill's safety and 'PASS' markers for security tests; these are evaluated as descriptive data and not as a valid security verdict.\n- [SAFE]: The skill suggests security best practices such as using temporary directories (mktemp) and git worktrees when reviewing external code to prevent contamination of the primary workspace.

coding-agent-hardened