The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill resolves the path to the ZCode CLI at runtime using environment variables or command-line arguments. This allows for the dynamic loading of executable content from computed paths, which could be exploited to point the agent to malicious binaries.
Evidence: References to resolving the CLI via the ZCODE_CLI environment variable or the --zcode-path flag.
[DATA_EXFILTRATION]: The skill documentation encourages interactions with sensitive local configuration files that store authentication data and provider settings.
Evidence: Instructions for reading and writing to ~/.zcode/cli/config.json to configure model providers.
[INDIRECT_PROMPT_INJECTION]: The skill creates a multi-agent vulnerability surface by ingesting untrusted task descriptions (briefs) and relaying them to an external autonomous agent (ZCode) that possesses broad system capabilities.
Ingestion points: Task briefs are accepted via the --brief flag (file-based) or through standard input.
Boundary markers: The brief is passed to the ZCode CLI as a file attachment using the --attach flag to separate it from the initial prompt.
Capability inventory: The sub-agent (ZCode) is capable of writing files and executing shell commands when running in yolo mode.
Sanitization: There is no evidence of sanitization, filtering, or validation of the brief's content before it is delivered to the sub-agent.
[COMMAND_EXECUTION]: The skill mechanism relies on the execution of shell commands to manage the delegation loop and interact with the ZCode CLI.
Evidence: Implementation via node scripts/relay.mjs which spawns and manages child processes.
[CREDENTIALS_UNSAFE]: The skill requires the user to provide sensitive authentication secrets to facilitate the delegation process.
Evidence: Instructions to set and use environment variables such as ZAI_API_KEY, ZCODE_API_KEY, and ANTHROPIC_API_KEY to authenticate the headless CLI.
[REMOTE_CODE_EXECUTION]: The skill depends on an external, unverifiable CLI tool that is not distributed through standard, trusted package registries and is resolved from arbitrary local application paths.
Evidence: The zcode CLI is described as shipping inside a desktop app bundle rather than being available via npm or standard system package managers.

zcode-delegate