The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash command templates (codex exec ... "<prompt>") that incorporate user-supplied prompts. This creates a risk of command injection if the agent does not properly escape the prompt content before execution. Malicious inputs containing shell meta-characters (e.g., ;, $(), `) could potentially execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The skill is designed to take local file content or conversation context and send it to external CLI tools (codex/GPT and gemini). While this is the documented and intended functionality, it represents a flow of potentially sensitive local information to third-party LLM providers.
[PROMPT_INJECTION]: The 'Round 2' process introduces an indirect prompt injection surface. It ingests responses from external models (Model A and Model B) and interpolates them directly into a follow-up prompt for a third model.
Ingestion points: Model outputs from Round 1 are processed as input for Round 2 in SKILL.md.
Boundary markers: The skill uses simple text labels ("Model A:", "Model B:") which provide minimal protection against adversarial instructions contained within those model outputs.
Capability inventory: The agent has access to Bash, Write, and Read tools, providing a wide range of actions that an injected instruction could exploit.
Sanitization: No evidence of sanitization, filtering, or instruction-ignoring delimiters for the injected model outputs was found in the skill instructions.

llm-council