The Agent Skills Directory

[COMMAND_EXECUTION]: The skill launches the 'Pi' worker process via child_process.spawn with shell: false. This approach prevents shell injection attacks. It also safely resolves Windows npm shims to avoid shell usage on that platform.
[CREDENTIALS_UNSAFE]: A dedicated redactSensitive function in scripts/pi-worker.mjs identifies and masks secrets such as API keys, authorization headers, and platform-specific tokens (e.g., GitHub, Slack) in the tool's output before it is processed or logged.
[INDIRECT_PROMPT_INJECTION]: The skill processes task objectives that could contain untrusted instructions. It mitigates this via:
Ingestion points: The objective and prompt fields in the JSON request.
Boundary markers: The buildPrompt function uses structured headers to separate task components.
Capability inventory: The worker process can read/write files and execute tools (e.g., bash, grep).
Sanitization: Input is validated by looksVague to reject non-atomic tasks, and output is scrubbed by redactSensitive.
[SAFE]: The skill implements significant defensive coding practices to ensure task delegation is performed within a bounded, monitored, and redacted environment.

pi-delegate