The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of external agentic binaries (opencode, cursor-agent, kiro-cli) which are designed to perform complex tasks, including file system modifications and shell command execution. Although the dispatcher script (run-model.sh) creates a new temporary directory for default runs, this provides only minimal working-directory isolation and does not prevent the tools from accessing absolute paths or the network.
[DATA_EXFILTRATION]: The skill provides a --context flag that allows the agent to read any local file readable by the user and include its contents in the prompt sent to external model providers. This creates a path for potentially sensitive data (such as configuration files or credentials) to be transmitted to third-party APIs if the agent is coerced or compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Malicious instructions embedded in files processed through the --context flag, or within the user-provided prompt, can influence the behavior of the external agentic tool. The skill uses a simple triple-dash (---) separator to distinguish context from the prompt, which can be easily bypassed by an adversary. This vulnerability is assessed in the context of its capability inventory, which includes broad subprocess and network access via the external CLIs.

external-model