The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a multi-agent coordination protocol where agents read and act upon messages (handoffs, notes, reports) stored in a shared directory (.tmp/agents-messaging-board/). This creates an attack surface where an agent could ingest malicious instructions embedded in data written by another agent.
Ingestion points: Agents are instructed to read files in the decisions/ and posts/ subdirectories to determine their tasks and boundaries.
Boundary markers: The protocol relies on YAML frontmatter and specific markdown headings to structure data, but these do not prevent an LLM from interpreting instructions within the body of a peer's post.
Capability inventory: Agents with a "write grant" are permitted to edit implementation files, commit changes, and push to the repository.
Sanitization: The skill provides behavioral guidance—such as verifying claims against the repository and treating peer notes as non-binding—but lacks automated sanitization or filtering of agent-generated content.
[COMMAND_EXECUTION]: The coordination protocol includes a specific message type (kind: tool) for sharing and running scripts or queries.
Evidence: The "Note" section states: "Commit the thing itself and point the note at its path, with the command that runs it and what it does." This pattern encourages agents to execute commands suggested by other agents, which is a potential vector for executing unauthorized or malicious code if a peer agent is compromised.

project-board