The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_claude.py executes the claude CLI using subprocess.run with a list of arguments, which is a secure practice to prevent shell injection. It also retrieves authentication tokens from the user's environment by invoking a login shell (bash -ilc or zsh -lic) to resolve the CLAUDE_CODE_OAUTH_TOKEN variable.
[DYNAMIC_EXECUTION]: The skill uses dynamic imports and sys.path manipulation to access shared libraries in the workspace. It also supports a fallback mechanism that invokes sibling scripts (e.g., codex-runner) based on paths resolved from the central routing configuration.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data from the primary prompt argument, multiple concatenated files via --prompt-file, and workflow context from --session-file.
Boundary markers: When concatenating multiple prompt files, the script inserts double newlines and triple-dash (---) delimiters to separate content sections.
Capability inventory: The skill can execute the claude CLI, which possesses capabilities for reading, globbing, and searching the repository. Write permissions are restricted by default for analysis roles and must be explicitly enabled.
Sanitization: External input is passed as a literal string argument to the subprocess, preventing command injection. However, the content is not filtered for embedded instructions targeting the underlying LLM.

claude-runner