The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating the --model and --dir flags directly into command strings (e.g., (cd '<dir>' && ...)). This implementation is vulnerable to command injection if the input values contain single quotes and shell operators (e.g., ' ; malicious_command ; '), allowing for arbitrary code execution on the host system.
[PROMPT_INJECTION]: The operational instructions mandate the use of flags that explicitly disable safety protocols and interactive confirmations in the underlying coding agents, such as --dangerously-skip-permissions for OpenCode and Claude, and approval_policy=never for Codex. This instructs the agent to bypass standard security guardrails and human-in-the-loop approvals.
[REMOTE_CODE_EXECUTION]: The skill acts as an execution wrapper for powerful external coding agents and processes untrusted 'task' input. The instruction shim provided to the agent ('The piped stdin is the complete task. Execute it exactly.') creates a surface for indirect prompt injection where malicious data embedded in the task can take full control of the agent's actions.
Ingestion points: Positional 'task' argument defined in SKILL.md.
Boundary markers: Absent; the skill lacks delimiters or instructions for the agent to ignore potentially malicious embedded instructions within the task data.
Capability inventory: Persistent file system modification (workspace-write) and arbitrary command execution through the opencode, codex, and claude CLI tools.
Sanitization: None; the skill explicitly states that task bytes are written 'unchanged' to the transport file and piped directly to the external tools.

assign