The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and relays information between different agent sessions, creating a vector for indirect prompt injection.
Ingestion points: GitHub issue descriptions fetched via gh (SKILL.md section 1) and worker agent outputs/transcripts read via herdr (SKILL.md section 4, scripts/watch.sh).
Boundary markers: The prompt templates in references/prompts.md do not utilize explicit delimiters (like XML tags or triple quotes) or specific 'ignore' instructions to isolate ingested data from the agent's primary instructions.
Capability inventory: The skill possesses significant capabilities, including executing git commands, creating/deleting worktrees, spawning new terminal panes, and managing GitHub pull requests (scripts/spawn.sh, scripts/mark.sh).
Sanitization: While internal state updates in run.json are handled safely via jq arguments (scripts/lib.sh), natural language communications relayed to worker agents are not sanitized for potential malicious instructions.
[COMMAND_EXECUTION]: The skill relies on local shell command execution to perform orchestration and environment management.
Evidence: Extensive use of git, jq, and the herdr CLI to manage worktrees, background processes, and agent sessions (scripts/spawn.sh, scripts/send.sh, scripts/watch.sh).

smith