deepseek

The documentation explicitly warns that the 'isolation' provided is merely detection after the fact, not a sandbox. The child process retains full shell access and can exfiltrate data or perform arbitrary actions, contradicting the implication of a secure, isolated 'grunt work' environment.

The 'Security — what isolation actually covers' section admits: 'it does NOT sandbox the child's process. From inside the worktree the child can still run arbitrary shell commands, write to absolute paths... or read/exfiltrate repo contents over the network.'

The documentation frames the skill as 'isolated' and 'sandboxed' while explicitly admitting it provides no process-level sandbox, allowing the child agent to execute arbitrary shell commands and exfiltrate data. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

Worktree isolation only contains the child's git-tracked file diffs — it does not sandbox the child's process. From inside the worktree the child can still run arbitrary shell commands, write to absolute paths outside the worktree, read/exfiltrate repo contents over the network.

The skill explicitly admits that 'worktree isolation' is not a sandbox and does not prevent the child process from executing arbitrary shell commands or exfiltrating data.

The delegated child runs with `Bash` in `ALLOWED_TOOLS`... it does NOT sandbox the child's process. From inside the worktree the child can still run arbitrary shell commands.

The skill routes tasks to an external API endpoint (`api.deepseek.com`) which acts as the 'child' agent. This creates a high risk of indirect prompt injection where the external model can return malicious instructions that the local `delegate` process will execute via `Bash`.

runs a nested, headless `claude` process pointed at DeepSeek's Anthropic-compatible endpoint

The `--file` argument is accepted by the CLI but not enforced, meaning the child agent has access to the entire repository despite the user's expectation of scoped access.

⚠️ `--file` is accepted but not yet enforced in v1 — see below.

NER model detected organization in skill content (confidence: 0.59)

D****