The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone source code from an untrusted GitHub repository (github.com/fendouai/CodexSaver.git) which is not associated with the skill's stated author or recognized trusted organizations.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands through the allowed_commands parameter in the codexsaver.delegate_work_packet tool. This allows the LLM to run any command provided in the tool call, such as pytest, mypy, or potentially malicious scripts.
[REMOTE_CODE_EXECUTION]: By combining the installation of untrusted code (pip install -e .) with the ability to execute commands via tool parameters, the skill establishes a high-risk environment for remote code execution.
[CREDENTIALS_UNSAFE]: The skill requires and handles multiple sensitive API keys (DeepSeek, OpenAI, Anthropic, Gemini, Qwen) stored in environment variables. While it mentions protected paths for .env files, the underlying tool has the capability to access the environment and local file system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task_description and goal parameters and passes them to external worker LLMs without clear boundary markers or sanitization.
Ingestion points: Untrusted data enters via task_description, goal, and files parameters in the delegate_task and delegate_work_packet tools (SKILL.md).
Boundary markers: None identified in the provided tool examples.
Capability inventory: The skill can execute shell commands (allowed_commands), write to the file system (allowed_files), and perform network operations via worker LLM APIs.
Sanitization: No evidence of input sanitization or filtering before interpolation into worker prompts.

codexsaver-cost-router