The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/install.sh script downloads code from github.com/fractalmind-ai/agent-manager-skill using both git clone and the openskills utility. This downloads third-party code that is then executed on the host system.
[REMOTE_CODE_EXECUTION]: The skill allows the definition of arbitrary launcher binaries and launcher_args in agent configuration files. These commands are executed by the skill's Python scripts in tmux sessions, providing an interface for executing arbitrary commands.
[COMMAND_EXECUTION]: The skill documentation and sample configurations in setup.sh explicitly use and recommend the --dangerously-skip-permissions flag for the Claude Code launcher. This flag bypasses interactive security prompts for tool use, significantly increasing the risk of automated malicious actions.
[PERSISTENCE]: The schedule sync and heartbeat sync commands modify the user's crontab to schedule recurring tasks. This establishes a persistence mechanism that can run arbitrary commands at defined intervals across system reboots.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files and injects it into agent sessions.
Ingestion points: Configuration and instruction data are read from agents/*.md and HEARTBEAT.md.
Boundary markers: Absent. The skill passes descriptions, tasks, and heartbeat instructions directly to agent sessions without delimiters or ignore-instructions warnings.
Capability inventory: The skill possesses capabilities for shell command execution, file system interaction, and modification of system persistence (crontab).
Sanitization: None. Input from repository files is used in shell commands and session messages without validation or sanitization.

agent-manager