The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_gemini.py utilizes subprocess.run to invoke the agy CLI tool and various sibling runner scripts. While it correctly uses list-based arguments to mitigate shell injection, the execution flow is determined by the AGY_CLI_PATH environment variable and local script paths.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by reading external content into the model prompt.
Ingestion points: The skill reads data from local files via the --prompt-file and --session-file arguments in scripts/run_gemini.py.
Boundary markers: While the skill injects a read-only instruction for analysis roles, the references/runtime-reference.md file explicitly states this is a soft constraint that the model can be injected into ignoring.
Capability inventory: The skill has the capability to trigger local CLI operations (via agy) which may include write actions depending on the local configuration.
Sanitization: The ingested content is concatenated into the final prompt without escaping or validation, relying on the model's obedience to soft instructions.

gemini-runner