The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the flow of untrusted user input from the ROOT Coordinator down to specialized subagents, creating a potential attack surface where instructions embedded in the task objective could influence subagent behavior.
Ingestion points: User-provided technical objectives and agent budgets are ingested by the ROOT Swarm Coordinator as described in SKILL.md and references/coordinator.md.
Boundary markers: The briefing templates (e.g., Coordinator -> Lead Agent Briefing Protocol) use markdown headers to structure the task but do not include explicit instructions or delimiters to isolate the untrusted objective from the subagent's operational instructions.
Capability inventory: Specialist subagents have access to run_command in a sandbox and write_file tools, while Lead Agents are permitted to use write_file for documentation purposes (as defined in the subagent manifests in assets/agents/).
Sanitization: The skill lacks explicit sanitization or validation of the user-provided objectives before they are interpolated into the subagent briefing prompts.
[DYNAMIC_EXECUTION]: The skill relies on the runtime generation and invocation of new agent contexts, which is a form of dynamic execution within the agent platform.
Evidence: The Coordinator and Lead Agents are instructed to dynamically register subagent types using define_subagent and initiate their execution via invoke_subagent, passing constructed prompt strings that include the task-specific details (referenced in references/coordinator.md and assets/agents/lead-agent.md).

swarm-coding