The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes Node.js code at runtime. In scripts/recover.js, the externalMergeObserver function generates a Node.js script as a string and executes it via process.execPath -e to perform PR observations in an isolated context.\n- [COMMAND_EXECUTION]: The skill relies heavily on executing external binaries and shell commands. It frequently invokes git and gh CLIs to manage repository state and PR lifecycle. It launches multiple external executor binaries (e.g., agy, claude, pi, agent, cline) as part of its core dispatch functionality. It manages process containment using an inherited scope marker (RELAY_PROCESS_SCOPE) to track and clean up child processes.\n- [CREDENTIALS_UNSAFE]: The skill performs sensitive authentication operations on the host. scripts/recover.js includes the resolveGithubObserverToken function, which calls gh auth token to obtain the operator's GitHub credentials for PR revalidation.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. (1) Ingestion points: Untrusted data enters the agent context through the --prompt and --prompt-file flags in scripts/dispatch.js, as well as via files copied into the worktree using the --copy option. (2) Boundary markers: The skill employs operational boundary markers such as [RELAY WORKTREE BOUNDARY] in scripts/adapters/antigravity.js and scripts/adapters/cline.js. (3) Capability inventory: The skill possesses extensive capabilities, including executing arbitrary commands via spawn and execFileSync across multiple scripts like scripts/host.js and scripts/exec.js. (4) Sanitization: The skill includes path-traversal checks using the contained and canonicalPathPrefix functions in scripts/run-store.js, but it does not perform semantic sanitization of all interpolated content.

relay-dispatch