The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is instructed to access and read sensitive local files that are known to store API keys and authentication tokens, including auth.json (for OpenCode and Pi providers) and ~/.codex/config.toml (for OpenAI/Codex).
[COMMAND_EXECUTION]: The skill constructs and executes shell commands using various third-party AI CLIs. While it implements shell-quoting protections for the prompt argument, it uses these tools to perform high-risk system operations without a secure sandbox.
[PRIVILEGE_ESCALATION]: Several CLI invocation contracts explicitly utilize flags designed to bypass security boundaries and human-in-the-loop oversight. These include --dangerously-bypass-approvals-and-sandbox for the Codex CLI, which removes the model's execution constraints, and --yolo, --trust, and --always-approve for the Cursor and Grok CLIs, which suppress user verification for agentic tasks.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for untrusted input to be processed by sub-agents with high system privileges. Ingestion points: Untrusted <prompt> text provided in the delegate command. Boundary markers: The prompt is delimited by single quotes in the shell to prevent immediate command injection, but there are no instructions to the sub-agent to ignore embedded commands. Capability inventory: The skill has the ability to execute multiple powerful CLIs with disabled sandboxes and local file access. Sanitization: There is a character-set whitelist for model and effort IDs, but the arbitrary prompt content is passed through without filtering.
[DATA_EXFILTRATION]: The skill is designed to capture and return the full output of external processes. This creates a data exfiltration path where a sub-agent, if compromised by a malicious prompt, could be directed to read and return the contents of the sensitive credential files (like auth.json) that the primary agent has already been instructed to locate.

delegate