The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to take raw text from a user and execute it directly as a literal shell command using a terminal tool. This provides a direct interface for arbitrary command execution on the host environment.
[REMOTE_CODE_EXECUTION]: Several instructions explicitly remove safety barriers:
The configuration disable-model-invocation: true prevents the AI model from evaluating the safety or intent of the command before it is passed to the shell.
Instruction 3 ("Do not rewrite, explain, or 'improve' the command") and Instruction 2 ("Execute that command immediately") ensure that no sanitization or human-in-the-loop checks occur, allowing malicious payloads to run as-is.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect injection. If the agent reads untrusted content (e.g., a file, web page, or git commit) containing the trigger /shell, it would execute any appended malicious commands immediately due to the lack of boundary markers or verification steps.
Ingestion points: Any user-provided text following the /shell trigger in SKILL.md.
Boundary markers: None present; the skill consumes all text following the trigger as a command.
Capability inventory: Full terminal tool access as implied by the "literal shell command" requirement.
Sanitization: Explicitly forbidden by the instruction to not "rewrite, explain, or 'improve'" the input.

shell