The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the user-provided --eval parameter directly in the shell to capture baseline performance metrics and evaluate results.
[COMMAND_EXECUTION]: User-supplied parameters {task} and {eval_cmd} are interpolated into a shell execution string for hub_init.py without explicit escaping or sanitization, creating a potential command injection surface.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the --task parameter which is passed to subsequent agent spawning steps.
Ingestion points: --task and --eval command parameters defined in SKILL.md.
Boundary markers: None present in the interpolation templates to delimit user input from shell command structures.
Capability inventory: Direct shell command execution, file system writes to the .agenthub/ directory, and recursive spawning of other agents via the Agent tool.
Sanitization: No evidence of escaping, validation, or filtering of external content before interpolation into shell commands.

run