The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly directs the agent to spawn subagents using the 'mode: bypassPermissions' configuration. This instruction is intended to override standard security prompts and permission checks for the orchestrated agents.
[COMMAND_EXECUTION]: The orchestrator is authorized to execute multiple system commands directly via the Bash tool, including process management ('kill', 'pkill'), network utilities ('getent', 'ldapsearch', 'ip'), and file system operations. It also generates and presents temporary bash scripts for the user to execute, including those requiring 'sudo' for host file updates and clock synchronization.
[REMOTE_CODE_EXECUTION]: The skill relies on the execution of several local scripts within the skill's environment (e.g., 'tools/hooks/event-watcher.sh', 'operator/templates/hosts-update.sh'). Furthermore, it dynamically constructs and executes logic by generating prompts for subagents based on data gathered from external targets.
[DATA_EXFILTRATION]: The skill includes logic to search for and read internal agent session logs (JSONL files) from the user's home directory ('~/.claude/projects/'). Accessing these transcripts could lead to the exposure of sensitive data from previous or concurrent agent interactions.
[PROMPT_INJECTION]: The skill processes untrusted data from targets and subagent summaries, which are then interpolated into new agent prompts. This creates a surface for indirect prompt injection, as the skill lacks robust sanitization or boundary markers for this external content.

orchestrator