The Agent Skills Directory

[COMMAND_EXECUTION]: The tool is designed to drive a sub-agent using bypassPermissions: true, which grants it the capability to read/write files and execute shell commands autonomously until a task is completed.
[INDIRECT_PROMPT_INJECTION]: The skill processes project directories (--cwd) as untrusted input. The documentation identifies a risk where malicious files in these directories could use prompt injection to trick the sub-agent into exfiltrating API keys or performing unauthorized actions.
Ingestion points: Files within the directory specified by the --cwd argument (e.g., CLAUDE.md, source code files) are read by the sub-agent during task execution.
Boundary markers: The tool implements a trust gate to prevent configuration hijacking, but does not employ specific delimiters or "ignore" instructions for the data processed by the sub-agent.
Capability inventory: The sub-agent has full access to the local shell, file system, and configured network endpoints via the Claude Agent SDK.
Sanitization: src/project-trust.mjs blocks dangerous configuration fields, but the tool does not sanitize the contents of the project files that are interpolated into the sub-agent's prompt.
[EXTERNAL_DOWNLOADS]: The tool performs network operations to external LLM provider endpoints and gateways, specifically targeting api.deepseek.com, api.moonshot.cn, test.flowus.work, and kollab.im.

agent-fleet