The Agent Skills Directory

[COMMAND_EXECUTION]: The 'Proxy Mode Pattern' constructs and executes a shell command using the Bash tool. It interpolates the user-provided {model_name} variable directly into the command line: npx claudish --stdin --model {model_name} --quiet --auto-approve. If a user provides a model name containing shell metacharacters (e.g., ;, &, or backticks), it could result in arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external directives (PROXY_MODE: {model_name}) from untrusted user input.
Ingestion points: The system instruction parses the start of incoming prompts for the PROXY_MODE directive.
Boundary markers: None identified. The task content and model name are extracted directly without sanitization.
Capability inventory: Uses the Bash tool to execute delegated tasks.
Sanitization: There is no escaping or validation of the {model_name} or {actual_task} variables before they are used in shell commands.
[DYNAMIC_EXECUTION]: The skill uses string interpolation to build executable bash commands at runtime, which are then passed to the agent's shell for execution. This pattern facilitates the command injection vulnerability described above.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the claudish package from the npm registry at runtime. While claudish is a known utility, dynamic package fetching and execution without version pinning or integrity checks introduce supply chain risks.
[AUTONOMY_ABUSE]: The instructions explicitly mandate the use of the --auto-approve flag when delegating tasks. This is a dangerous practice as it suppresses the user's ability to review and approve potentially destructive actions taken by the delegated agent.

patterns