The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to run git branch --show-current in order to automatically derive a team name from the user's current development environment.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads and writes configuration files in ~/.claude/teams/. This directory is the standard location for storing agent team metadata on the supported platform, and the skill accesses it to track member roles and statuses for management operations.
[PROMPT_INJECTION]: The skill defines several specialized agent roles (Planner, Implementer, Architect, Reviewer, etc.) using detailed prompt templates. These templates specify role boundaries and communication rules, such as requiring all messages to flow through a central 'team-lead'.
[INDIRECT_PROMPT_INJECTION]: The orchestrated workflow involves multiple agents passing information (such as specifications and task updates) between each other. This creates a chain of trust where data ingested from the project environment can influence the actions of multiple agents.
Ingestion points: User instructions and project files are read by the 'team-lead' and passed to the 'Planner' (in SKILL.md and work-guide.md).
Boundary markers: The prompt templates do not currently implement explicit delimiters or safety instructions to distinguish between system-level directives and potentially untrusted content within teammate messages.
Capability inventory: Sub-agents are granted significant capabilities including shell access via Bash, the ability to spawn further agents via Agent, and project file system access. Background execution (run_in_background: true) further reduces user oversight during these operations.
Sanitization: There is no explicit evidence of sanitization or content filtering for messages passed between the different agent roles.

create-team