The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the Warp Agent CLI (oz) to be installed and authenticated on the system. It also mandates Node.js 18+ and git as prerequisites for operation.
[DATA_EXFILTRATION]: By default, the oz agent run command uploads a snapshot of the workspace to Warp's servers. Although the skill documentation explains how to use the --no-snapshot flag to prevent this, the default behavior constitutes a data exposure surface for sensitive environments.
[COMMAND_EXECUTION]: The delegated implementer (oz) executes shell commands and file operations without a sandbox or permission restrictions, using the host user's own permissions.
[REMOTE_CODE_EXECUTION]: The skill instructions depend on a relay.mjs script that is not included in the source files. The documentation directs the agent to execute this script from a community GitHub repository (amElnagdy/delegate-skills), which has not been verified.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest local codebase content into prompts for a sub-agent. It lacks structural boundary markers to isolate untrusted file content from the agent's core instructions.
Ingestion points: Local source files (e.g., src/strings.js) and project documentation (CONTRIBUTING.md) are read and included in the implementation brief.
Boundary markers: Absent; the skill relies on natural language descriptions to separate the task goal from the provided code context.
Capability inventory: The sub-agent (oz) can execute arbitrary shell commands and modify any file in the workspace.
Sanitization: No sanitization or filtering is performed on the ingested workspace data before it is interpolated into the brief.

warp-delegate