The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to utilize shell access for delegating tasks to external processes. In delegation.md, it states, "say 'shell out' — the agent already has Bash," and provides specific examples of running non-interactive commands such as codex exec -s read-only.
[DYNAMIC_EXECUTION]: The instructions describe a "wrapper pattern" in delegation.md where the agent is instructed to dynamically generate a "self-contained CLI prompt" and then "run it via Bash." This involves the runtime assembly and execution of commands, which can be difficult to audit for safety.
[INDIRECT_PROMPT_INJECTION]: The skill design establishes a multi-step chain where output from an external, potentially untrusted source (a delegate model via CLI) is ingested into the primary agent's context.
- Ingestion points: Data enters the agent's context through the output of shell commands in delegation.md.
- Boundary markers: The skill suggests labeling output (e.g., {label: 'gpt-5.6:review-auth'}), but lacks robust delimiters or explicit instructions to ignore embedded commands within the delegate's report.
- Capability inventory: The agent is granted capabilities including Bash execution, spawning subagents with the agent() tool, and file system operations using isolation: 'worktree'.
- Sanitization: Beyond the suggestion to use a schema for structured output, there is no mention of sanitizing or filtering natural language content returned by the external delegate models.

prompting-fable