The Agent Skills Directory

[COMMAND_EXECUTION]: The skill introduces a CLI tool with a --agent <command> parameter. This acts as an escape hatch that allows for the execution of arbitrary shell commands. If an agent is successfully manipulated, this could be used to run malicious payloads directly on the host system.
[EXTERNAL_DOWNLOADS]: The built-in agent registry maps friendly names to npx execution strings (e.g., pi-acp, opencode-ai, @kilocode/cli). These rely on the NPM registry for runtime code delivery without version pinning or integrity verification, creating a supply chain risk.
[REMOTE_CODE_EXECUTION]: Several default agent configurations use npx to fetch and run remote code at execution time. This includes packages from various third-party sources like @zed-industries/claude-agent-acp and opencode-ai.
[COMMAND_EXECUTION]: The --approve-all flag provides a way to suppress all interactive permission prompts for file system and terminal operations. This disables the primary human-in-the-loop safety mechanism, allowing an agent to perform sensitive actions without oversight.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to process external inputs for agent-to-agent communication.
Ingestion points: Prompt text provided via command line arguments, stdin, or external files using the -f/--file flag.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are documented for the input processing.
Capability inventory: The skill facilitates file system access, terminal requests, and arbitrary command execution (via --agent) across its various modes and agents.
Sanitization: The description does not mention any sanitization or validation of the input text before it is passed to the underlying ACP adapters.

acpx