The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct shell commands using unquoted placeholders such as <name> and <mapped>. Because these values can be derived from external files or user input (e.g., an agent named with a semicolon), they present a significant risk of command injection where arbitrary code could be executed in the host environment.- [PRIVILEGE_ESCALATION]: The skill requires the Shell tool to be invoked with required_permissions: ["all"] to bypass standard sandbox restrictions for network access and file writes to the user's home directory (~/.claude). Furthermore, it intentionally bypasses platform-level safety features such as the workspace trust dialog and the built-in review and undo capabilities for file modifications.- [INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads agent instructions and metadata from multiple local project and home directory paths (.cursor/agents/, .claude/agents/, .codex/agents/).
Boundary markers: It employs single-quoted heredocs (cat <<'BRIEF') to encapsulate the task body, which effectively prevents variable expansion and command substitution within that specific block.
Capability inventory: The skill utilizes the Shell tool with full permissions, enabling file system modification, network operations, and execution of the claude CLI.
Sanitization: While it provides instructions to escape quotes and newlines when generating JSON for Cursor-format agents, it lacks robust shell-level sanitization or quoting for CLI arguments like the agent name and model identifier.

use-claude-code-subagents