The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage project directories, start a background hub process ('node dist/bin/hub.js'), and orchestrate terminal sessions using 'tmux' on Unix-like systems or 'wt' (Windows Terminal) on Windows.
[DYNAMIC_EXECUTION]: The skill dynamically generates JavaScript files ('/tmp/vibehq-run-spawn.js' and '/tmp/vibehq-run-poll.js') at runtime and executes them using the Node.js runtime to manage agent lifecycle and polling.
[PRIVILEGE_ESCALATION]: The spawning process explicitly utilizes the '--skip-permissions' flag when launching agents, which bypasses built-in security prompts and permission restrictions for the tasks performed by the spawned agents.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project descriptions from user arguments and interpolates them directly into a system prompt for a Project Manager agent without sanitization or boundary markers. This Project Manager agent has the capability to assign tasks, define research goals, and coordinate workers, providing a vector for malicious input to influence the behavior of the entire agent team. Evidence: Ingestion in SKILL.md ($ARGUMENTS); Boundary markers: Absent; Capability inventory: File writes (fs.writeFileSync), process execution (exec/execSync), and directory management; Sanitization: Absent.

run-teamwork