The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions utilize custom command-line utilities qwen-dispatch and qwen-escalate to facilitate task execution and model routing. These tools interface with both local (Ollama) and cloud (Qwen OAuth) backends and manage state within the user's home directory under ~/.qwen/.
[INDIRECT_PROMPT_INJECTION]: The skill defines a significant attack surface for indirect prompt injection by processing untrusted user input within a context that has extensive system capabilities.
Ingestion points: Untrusted user descriptions are ingested via positional arguments in the qwen-dispatch, qwen-escalate, think, plan, and auto commands.
Boundary markers: The skill definition lacks explicit boundary markers or instructions to the models to disregard directives embedded within the processed data.
Capability inventory: According to the routing decision matrix, the system has access to a wide array of Model Context Protocol (MCP) tools, including filesystem, github, postgres, docker, kubernetes, and terraform. This provides the potential for unauthorized file modifications, infrastructure changes, or data access if an injection is successful.
Sanitization: There is no evidence of sanitization, filtering, or validation of the user-provided prompts before they are interpolated into the model workflow.

qwen-dispatch