The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill orchestrates sub-agents that ingest and process untrusted data from the codebase and user tasks.
Ingestion points: User task input, codebase files (scanned via the explore tool), stage handoff markdown files, and task-specific JSON files in the user directory.
Boundary markers: Handoff content is included in sub-agent prompts without explicit isolation delimiters or safety instructions to ignore embedded commands.
Capability inventory: Orchestrated sub-agents possess tools for full filesystem access (Read/Write/Edit), bash execution, and recursive agent spawning.
Sanitization: Git branch names are sanitized to prevent injection, but no other explicit sanitization of user-provided task content or codebase content is mentioned.
[EXTERNAL_DOWNLOADS]: The skill recommends installing and uses external CLI tools from well-known providers, specifically @openai/codex and @google/gemini-cli, for specialized worker tasks.
[SAFE]: The skill uses Claude Code's native team management API and local state files in ~/.claude/ which is standard behavior for the platform's team functionality.

team