The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to invoke several external CLI tools (claude, codex, gemini) to process data.
[DYNAMIC_EXECUTION]: The skill constructs shell commands by interpolating a $PROMPT variable directly into a command string, which is a form of dynamic command generation.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user data which is then interpolated into shell commands.
Ingestion points: User-provided task descriptions are used to populate the $PROMPT variable in SKILL.md.
Boundary markers: The instructions do not implement boundary markers or instructions for the agent to distinguish between the prompt's content and the shell command structure.
Capability inventory: The skill makes use of the bash tool for parallel command execution.
Sanitization: There are no instructions for sanitizing or escaping the user-provided data before it is executed in a shell environment, which could allow an attacker to execute arbitrary commands by including shell metacharacters in their request.
[METADATA_POISONING]: The skill specifies a gpt-5.5 model for the codex tool. This is a non-existent model version, which could indicate either a hallucinated command or a reference to a non-standard or potentially malicious utility.

peer-review