The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent delegation architecture that forwards user-controlled task descriptions to child agents, creating an inherent attack surface for instruction hijacking.- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Untrusted data enters the agent context through the coordinator.ask() method in assets/research_squad.py and via the objective parameter in Agent.as_tool() calls described in SKILL.md.- [INDIRECT_PROMPT_INJECTION]: Boundary markers: The current implementation examples lack explicit delimiters (such as XML tags or structured JSON wrappers) and specific 'ignore' instructions to isolate the user-provided sub-task descriptions from the sub-agent's system instructions.- [INDIRECT_PROMPT_INJECTION]: Capability inventory: Sub-agents inherit the tool suite of their parent by default (e.g., search_tool, fetch_url), which allows injected instructions to potentially trigger external actions or data retrieval.- [INDIRECT_PROMPT_INJECTION]: Sanitization: The provided scripts do not demonstrate validation or sanitization of the strings passed to run_subtasks or delegate tool calls, relying on the LLM's internal safety filters to distinguish between tasks and commands.

ag2-subagent-delegation