The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external CLI tools (gemini, codex) using shell commands with flags designed to bypass user confirmation, such as --approval-mode yolo and --full-auto. This configuration allows autonomous tool execution without human oversight.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting untrusted user markdown files to generate plans and execution prompts for other agents.
Ingestion points: User-supplied specification file path in SKILL.md.
Boundary markers: No explicit delimiters or ignore instructions are used to wrap user content in synthesized files.
Capability inventory: Subagent creation via Task tool, file writing, and bash command execution.
Sanitization: User input is not sanitized before interpolation into prompts.
[EXTERNAL_DOWNLOADS]: The skill documentation encourages the installation of external CLI tools. While these tools originate from well-known organizations (Google and OpenAI), their integration creates a dependency on external code.
[METADATA_POISONING]: The skill references a fictional gpt-5.2 model and a codex CLI tool that does not appear to exist in the functional form described in the referenced repository, which is deceptive and could lead to the execution of unintended binaries.

gepetto