The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates data from several untrusted sources to construct a final prompt for the Cline agent, which has autonomous capabilities like shell and filesystem access.
Ingestion points: Untrusted data enters the agent context through the positional prompt argument, as well as the --prompt-file, --session-file, and --metadata-json flags processed in scripts/run_cline.py.
Boundary markers: The build_prompt function in scripts/run_cline.py uses plain text delimiters (e.g., "Execution metadata:", "Prior conversation context to continue from:") to separate sections. These are not robust against adversarial content designed to break out of delimiters.
Capability inventory: The skill executes the Cline CLI, which possesses capabilities for reading and writing files, and executing arbitrary shell commands, particularly when not restricted to 'plan' mode.
Sanitization: No escaping, validation, or filtering of the external content is performed before it is interpolated into the final prompt.
[COMMAND_EXECUTION]: The skill uses the subprocess.run function to execute the cline binary. It correctly follows security best practices by passing arguments as a list rather than a shell string, preventing direct command injection into the wrapper itself.
[PERSISTENCE]: Invoking the skill with the --model flag causes a persistent side effect on the host system by overwriting the user's global Cline configuration file (~/.cline/data/settings/providers.json). While documented, this changes the behavior of subsequent interactive Cline sessions.
[EXTERNAL_DOWNLOADS]: The documentation identifies the cline CLI as a mandatory prerequisite, directing users to install it via a remote registry using npm install -g cline.

cline-runner