The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts (claude_delegate.py, codex_delegate.py, and delegate_common.py) use subprocess.run to execute external binaries including git, claude, and codex. These executions are central to the skill's purpose of delegating work to external runners. The arguments for these calls are constructed from fixed templates and validated inputs.
[INDIRECT_PROMPT_INJECTION]: The skill identifies and mitigates indirect prompt injection risks by wrapping user missions in a hardened envelope using random hex boundary markers (e.g., <<<mission {boundary}>>>). This is designed to prevent the subagent from following instructions embedded in untrusted workspace data, comments, or tool outputs.
[DATA_EXPOSURE]: The scripts read workspace files and Git metadata to generate filesystem manifests. This data is used exclusively for security reconciliation—verifying that the subagent stayed within its write allowlist—rather than exfiltration. The minimal_child_env function in delegate_common.py implements a strict allowlist for environment variables to prevent leaking sensitive system tokens or cloud credentials to subagent processes.

vibe-orchestrate