The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of external agent binaries or scripts. It implements several 'assume-malicious' safety measures in its host.sh script:
Shell Syntax Blocking: The script explicitly searches for and rejects shell meta-characters (e.g., ;, &, |, <, >, `, $, \, ", ') in the command string to prevent shell injection attacks.
Interpreter Blacklist: It prohibits the use of common command interpreters (e.g., bash, python, node, perl, ruby) as the primary executable to prevent users or repositories from bypassing the shell-free execution model.
Supply Chain Security: The script verifies that product-level configuration files (.agent-workflows/spawn) are not tracked by Git. This ensures that a malicious repository cannot ship with a pre-configured attack command that executes automatically when the user runs the skill.
Symlink and Path Protection: The script refuses to read configuration from symbolic links, mitigating potential path traversal or redirection risks.
[SAFE]: No obfuscation, data exfiltration, or persistence mechanisms were detected. The skill uses a fixed, hardcoded prompt for spawned workers and restricts its control logic to a small set of predefined status tokens parsed from a local progress file.

host-workflows