The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the agentic-flow@alpha package during both pre-execution and post-execution hooks. Using an unpinned version tag (@alpha) from a non-standardized external source introduces a supply chain risk.
[REMOTE_CODE_EXECUTION]: The use of npx in the pre_execution and post_execution hooks constitutes remote code execution, as it fetches and executes JavaScript from the npm registry at runtime.
[COMMAND_EXECUTION]: The post_execution hook contains a shell command injection vulnerability where the $TASK environment variable is interpolated directly into a shell string: echo "V3 Orchestration: $TASK". If the task content contains shell metacharacters (e.g., backticks or semicolons), it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection due to its role in orchestrating a 15-agent swarm.
Ingestion points: The skill ingests untrusted data via the $TASK variable in the post_execution hook.
Boundary markers: There are no visible boundary markers or delimiters used to isolate task data from the command structure.
Capability inventory: The skill possesses extensive capabilities including shell execution (hooks), GitHub CLI interactions (gh), and the ability to coordinate and pass tasks to 14 other specialized agents.
Sanitization: No sanitization or escaping is performed on the $TASK variable before it is used in shell hooks.

agent-v3-queen-coordinator