The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/invoke.py uses subprocess.run to execute an external manager engine found on the local filesystem. This engine receives user-supplied input via stdin.
[DYNAMIC_EXECUTION]: The skill dynamically identifies its execution engine by scanning a extensive list of potential hidden directories in the user's home folder (e.g., ~/.cursor/skills, ~/.claude/skills, ~/.aider-desk/skills), which is a technique that could be misused if malicious files are placed in these locations.
[PERSISTENCE]: The skill is designed to modify persistent environment configuration files, including AGENTS.md and harness-specific global context files like ~/.claude/CLAUDE.md, to inject "standing instructions" and pointer blocks that remain active across agent sessions.
[DATA_EXPOSURE]: Instructions in references/mode.md direct the agent to read sensitive session log files and JSONL metadata located in ~/.claude/projects/ to determine current permission settings.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerable surface where untrusted data enters the agent context via sys.stdin in scripts/invoke.py. Although a boundary separator (--) is mentioned in help.md, the input is passed verbatim to a subprocess.run call without visible sanitization or filtering of the external content.

delegation