The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/relay.mjs script executes the oz (Warp Agent CLI) and git binaries using node:child_process.spawn and node:child_process.spawnSync.
Arguments are constructed as an array and executed without a shell (shell: false), which prevents shell injection vulnerabilities from the brief content.
The script validates certain command-line tokens (model, profile, conversation) against a strict alphanumeric-and-limited-symbols regex (SAFE_TOKEN).
The documentation in references/writing-the-brief.md warns that the brief is visible in process lists (e.g., ps), advising users to keep secrets out of task descriptions.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest a user-provided "brief" and pass it as a prompt to the oz agent, which has broad system access.
Ingestion points: Task briefs are ingested via the --brief flag or stdin and passed as the --prompt argument to the oz CLI in scripts/relay.mjs.
Boundary markers: The skill includes detailed instructions in SKILL.md and references/writing-the-brief.md on structuring briefs with a "report contract" and explicit "do not commit" commands to restrict agent behavior.
Capability inventory: The oz agent operates with the user's local permissions, capable of reading, writing, and executing shell commands. The relay script also uses git status --porcelain to identify modified files.
Sanitization: While the relay script sanitizes metadata flags, it does not sanitize the content of the task brief, as it is intended for interpretation by the sub-agent AI.

warp-delegate