The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Python subprocess module and shell scripts to wrap local command-line tools including claude, codex, and the custom watercooler service. These calls are parameterized and use safe execution patterns, such as passing arguments as lists, to prevent shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: As a message relay between AI agents, the skill handles untrusted data originating from different session contexts. It mitigates the risk of indirect injection by wrapping all relayed content in 'envelopes' that clearly label the provenance of the message, distinguishing collaborator input from owner instructions, and explicitly warning the receiving agent about permission boundaries.
[DATA_EXPOSURE]: The skill manages session state, bindings, and delivery receipts in local directories (e.g., ~/Library/Application Support/ClaudeAdvisor). It strictly enforces secure file permissions using umask 077 and chmod 600 to ensure this metadata remains private to the local user and inaccessible to other processes.
[DYNAMIC_EXECUTION]: The advisory functionality implemented in scripts/consult-claude-model.sh utilizes Claude Code's restricted mode to enforce a read-only environment. It explicitly limits the advisor model's capabilities to a minimal set of tools (Read, Grep, Glob) and denies access to dangerous operations such as shell execution, file writing, and network access.

watercooler