The Agent Skills Directory

[METADATA_POISONING]: The skill metadata identifies the author as 'Claude', which is inconsistent with the provided author context of 'igorwarzocha'. This is a deceptive practice that misrepresents the origin of the skill, potentially to leverage the reputation of a well-known AI provider.
[INDIRECT_PROMPT_INJECTION]: The orchestrator environment created by this skill is susceptible to indirect prompt injection because it is designed to ingest and process data from external local servers without sufficient safeguards.
Ingestion points: The generated AGENTS.md instructs the agent to use curl to fetch data from /config and /agent endpoints on a range of local ports (3001-3010).
Boundary markers: The instructions lack any boundary markers or directives to treat the retrieved server data as untrusted, increasing the risk that instructions embedded in a server's response could be executed.
Capability inventory: The orchestrator is configured to run 'curl' and 'jq' commands automatically, providing a vector for automated network operations and data manipulation.
Sanitization: The skill does not implement any validation or sanitization of the server responses before they are presented to the orchestrator agent's context.
[COMMAND_EXECUTION]: The skill uses shell commands to initialize the project environment. It specifically creates a configuration file (.opencode/opencode.json) that grants 'allow' permissions for 'curl' and 'jq' commands, effectively bypassing manual user approval for these sensitive tools in the resulting orchestrator environment.

opencode-orchestrator-creator