The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell scripts to manage the lifecycle of worker agents. It executes commands for git worktree management (git worktree add), project automation via the GitHub CLI (gh issue list, gh pr list), and agent control through the Herdr CLI (herdr agent start, herdr tab create). These operations are necessary for its core functionality as an orchestrator.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes data from external sources.
Ingestion points: It reads content from GitHub issues (gh issue list), worker agent outputs (herdr agent read), and agent transcript files located in user directories (e.g., ~/.claude/projects/*).
Boundary markers: The orchestrator uses specific prompt templates in references/prompts.md and instructions in SKILL.md to wrap and relay information between the user and workers, including a policy of quoting user decisions exactly.
Capability inventory: The orchestrator can execute shell commands, perform git operations, manage PRs via gh, and spawn/control other AI agents.
Sanitization: The skill mitigates risks by enforcing a "Relay, recommend, wait" policy. It is explicitly instructed that no code is shipped, no PR is opened, and no text is posted to external platforms without manual user approval at defined "gates."
[PERSISTENCE]: The skill uses background processes (watch.sh via nohup) to monitor worker progress while the main orchestrator session is idle. This is a functional requirement for parallel task orchestration and does not involve modifications to system startup scripts or profiles.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses agent session logs and project transcripts (e.g., ~/.claude/, ~/.codex/) to facilitate resuming conversations and relaying progress to the user. This data remains within the local environment and the orchestrator's session, with no evidence of unauthorized external exfiltration.

agent-smith