The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run node scripts/daemon-bridge.js plan "<task>". Incorporating the <task> variable directly into a shell command creates a command injection vulnerability where a user-provided prompt could break out of the quotes and execute arbitrary commands on the host machine.
[EXTERNAL_DOWNLOADS]: The documentation explicitly directs the user/agent to clone the repository github.com/Suraj1235/open-dynamic-workflows and execute npm install. This involves downloading and running third-party code from a community source that is not recognized as a trusted organization.
[REMOTE_CODE_EXECUTION]: The workflow involves generating and executing "compiled orchestration scripts" via a local daemon. This capability allows for the dynamic execution of logic that is influenced by user-controlled tasks, which can be exploited to run unauthorized code if the planning logic is compromised.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill accepts a raw <task> string from the user in SKILL.md to be processed by the planning engine.
Boundary markers: While the task is enclosed in quotes in the command line, there are no instructions for the agent or the underlying engine to ignore potentially malicious instructions embedded within the task content.
Capability inventory: The skill utilizes subprocess execution via node and has the ability to manage 16–100 concurrent agents, which could be leveraged for large-scale automated actions.
Sanitization: No evidence of input sanitization or validation is provided for the task data before it is passed to the orchestration scripts.

odw