The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_grok.py uses subprocess.run() to execute the local grok CLI. The command arguments are constructed from user-supplied inputs such as the prompt, model ID, and file paths. The implementation uses a list of arguments, which is a best practice to mitigate shell injection risks, but the skill inherently grants the agent the ability to execute the local CLI binary.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests untrusted data from multiple sources.
Ingestion points: External data enters the agent context via the --prompt-file, --session-file, and --metadata-json arguments in scripts/run_grok.py.
Boundary markers: The script uses simple text headers (e.g., 'Role:', 'Execution metadata:') and newline separators to delineate segments, which may be insufficient to prevent a model from obeying instructions embedded within the ingested data.
Capability inventory: The skill has the capability to read local files (Path.read_text), write files (write_json_output_file), and execute the grok command (subprocess.run).
Sanitization: There is no evidence of sanitization or filtering of the content read from external files before it is interpolated into the final prompt.
[DATA_EXPOSURE]: The skill's primary function involves reading local file content and sending it to an external LLM provider (xAI). The documentation in SKILL.md and references/runtime-reference.md explicitly states that prompt and file context are transmitted to the configured provider and that sessions are persisted in the user's home directory (~/.grok).

grok-runner