The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator's configuration in config/cli-config.yaml explicitly enables unsafe execution modes for various AI CLI tools. It uses flags such as --dangerously-skip-permissions for Claude Code and --yolo or --full-auto for Gemini, Qwen, Codex, and Cursor. This bypasses the security models of these platforms, allowing autonomous agents to execute shell commands and modify the filesystem without human-in-the-loop verification.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection. It ingests data from untrusted sub-agent outputs (result-{agent-id}-{sessionId}.md) and progress files, which are then interpolated into subsequent prompts via resources/subagent-prompt-template.md without sanitization.
Ingestion points: Result and progress files stored in the .serena/memories path.
Boundary markers: The system relies on standard markdown headers but lacks instructions for the orchestrator to disregard potentially malicious commands embedded in agent results.
Capability inventory: The skill has the ability to spawn arbitrary processes and write to the local filesystem across the entire codebase.
Sanitization: No input validation or escaping is applied to the task descriptions or sub-agent results before they are used to build new task boards or prompts.
[COMMAND_EXECUTION]: The provided scripts (scripts/spawn-agent.sh, scripts/parallel-run.sh, scripts/verify.sh) use exec to pass all arguments directly to the oma CLI tool. This pattern can lead to command injection if agent IDs or session IDs are manipulated to include shell metacharacters.

oma-orchestrator