The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data that could contain malicious instructions.
Ingestion points: The agent retrieves task lists and specific task details using the get-tasks and get-task-details tools.
Boundary markers: There are no instructions provided to the agent to treat task descriptions as untrusted data or to use delimiters to prevent instruction hijacking.
Capability inventory: While this skill primarily coordinates, it delegates actual execution to /skill:work-on-task and persists state via store-progress. Malicious tasks could influence the agent's behavior during the 'work-on-task' phase.
Sanitization: No validation or sanitization logic is defined for the content of the tasks retrieved from the swarm.
[DATA_EXPOSURE]: The skill utilizes a shared filesystem (/workspace/shared) for collaboration between agents. While this is an intended feature for a swarm architecture, it creates a shared data surface where multiple agents can read and write files, requiring users to ensure that sensitive data is not inadvertently placed in the shared directory.

start-worker