The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill configures sub-agents with the --dangerously-skip-permissions flag during the herdr agent start process. This instruction explicitly disables the safety guardrails that would otherwise require human confirmation for tool calls and command execution within those agent sessions.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context from external issue trackers (GitHub/Linear) via issue titles, bodies, and comments, as well as from the repository's source code and PR descriptions.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agents to ignore embedded instructions within the ingested data.
Capability inventory: The orchestrator and its agents possess extensive capabilities, including full repository access via git, worktree management via wt, session management via herdr, and the ability to run arbitrary test suites and application code.
Sanitization: There is no evidence of sanitization or validation of the external content before it is processed by the agents to form implementation plans and execution steps.
[REMOTE_CODE_EXECUTION]: The skill directs agents to execute local code as part of its core loop, including running tests (/mattpocock-skills:tdd), typechecking, and exercising the application for QA purposes. Because these agents operate with bypassed permissions, this constitutes autonomous execution of potentially untrusted logic derived from the repository.
[EXTERNAL_DOWNLOADS]: The skill relies on external, third-party CLI tools and skills that are not from trusted providers, including herdr, wt (worktrunk), and skills from the mattpocock-skills namespace. These dependencies are required for the skill to function but originate from unverified sources.
[COMMAND_EXECUTION]: The orchestrator makes extensive use of system commands through herdr, wt, git, and gh. It manages background processes and interactive sessions that can modify the local file system and remote repository state autonomously.

stampede