The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates a delegation workflow where sub-agents process external data, creating a surface for indirect prompt injection.
Ingestion points: Sub-agents read task briefs from prompt.md and analyze code within the specified work directory.
Boundary markers: The skill does not provide mechanisms or instructions for delimiting untrusted data from the system prompt, which may lead the sub-agent to follow instructions embedded in the project files or the brief itself.
Capability inventory: The sub-agent configurations (editor.md and reviewer.md) include bash for shell command execution, edit for file modifications, and webfetch for outbound network requests.
Sanitization: There is no mention of sanitizing the task brief or the code files before they are processed by the sub-agent.
[COMMAND_EXECUTION]: The skill instructions direct the primary agent to execute various shell commands, including directory creation (mkdir), file copying (cp), and initializing git worktrees (git worktree add). These commands are used to set up the execution environment for the sub-agent.
[DATA_EXFILTRATION]: The sub-agent profiles are configured with webfetch: allow. This permission allows the agent to communicate with external web services. In the event of a successful prompt injection attack, this capability could be abused to exfiltrate sensitive data, such as environment variables or source code, to a remote server.

delegate-to-opencode