The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions promote the use of the --yolo flag for coding agents, which is described as disabling sandboxing and approval requirements ("NO sandbox, NO approvals"). This poses a risk of unauthorized or harmful system modifications.
[COMMAND_EXECUTION]: The skill documents the use of an elevated parameter for its bash tool, which allows commands to be executed on the host system rather than within a restricted sandbox environment.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing a specific third-party Node.js package (@mariozechner/pi-coding-agent) and involves cloning external git repositories for processing, which introduces supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted code (e.g., during PR reviews), creating a vulnerability where malicious instructions embedded in the external code could be followed by the coding agent.
Ingestion points: Untrusted data enters the context via git clone and gh pr checkout as described in SKILL.md.
Boundary markers: None are present; there are no instructions to the agent to disregard instructions contained within the code being processed.
Capability inventory: The skill utilizes a bash tool with capabilities for background execution and potential host elevation.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill suggests a pattern where sub-agents are instructed to execute shell commands (openclaw system event) to notify the parent agent of completion, providing an additional execution vector.

coding-agent