The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The references/setup.md file directs users to run a setup command using npx which downloads and executes code from the author's repository (github:miguelrios/unc-skills#main). While this is a vendor-owned resource, it involves remote code execution at the installation phase.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by routing incoming Slack replies into active AI agent sessions (e.g., Claude Code, Codex).
Ingestion points: Slack messages received via Socket Mode or polling as described in SKILL.md and references/contract.md.
Boundary markers: The skill mentions stripping synthetic history before resuming sessions, but does not explicitly define robust delimiters (like XML tags) for untrusted Slack content.
Capability inventory: The bound agent sessions typically have high-privilege capabilities including file system access and shell execution.
Sanitization: The skill contract mandates credential redaction at the Slack egress point and performs process fingerprinting to ensure input is only sent to the specific terminal pane intended for the agent.
[COMMAND_EXECUTION]: The scripts/tether_notify.py script uses subprocess.run to execute commands via the hermes binary. These commands manage gateway services (start, restart, install) and plugin configuration. The execution uses list-based arguments which mitigates shell injection risks.
[DYNAMIC_EXECUTION]: The notification script dynamically loads a runtime module (bridge_runtime.py) from the user's local data directory (~/.local/share/tether/) using importlib. This allows the script to execute code that is not statically present in the distributed skill files.

tether