The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides tools to delegate complex tasks to an autonomous worker (execute_task) and to import executable logic from a cloud community (cloud_browse_skills). This functionality allows for the execution of remote code and behaviors that are not defined within the skill's own instructions.
[CREDENTIALS_UNSAFE]: The cloud_auth_flow tool accepts a password parameter as a direct argument. Passing sensitive credentials as plain-text tool parameters is a high-risk practice as they may be captured in execution logs, process listings, or debugging telemetry.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection. It executes natural language instructions which could be sourced from untrusted data, and it imports skills contributed by a cloud community that could contain malicious instructions.
Ingestion points: Untrusted data enters via the task parameter in execute_task and the logic imported through cloud_browse_skills.
Boundary markers: None are present to distinguish between trusted instructions and embedded data.
Capability inventory: The skill has access to DevOps tools, desktop automation, and cloud upload capabilities.
Sanitization: There is no mention of sanitization, validation, or integrity checking for imported skills or task instructions.
[COMMAND_EXECUTION]: The instructions direct the user to run local shell commands (openspace-cloud-auth) to perform authentication tasks, which involves local execution of vendor-specific CLI tools.
[DATA_EXFILTRATION]: The upload_skill tool enables the transmission of local directory contents (skill_dir) to an external cloud service. While intended for sharing skills, this mechanism could be misused to exfiltrate sensitive files if the agent is directed to a path containing private data.

delegate-task