The Agent Skills Directory

[DYNAMIC_EXECUTION]: The RunWorkflow tool executes arbitrary JavaScript (ES2020) code server-side to orchestrate subagent tasks. While the script environment is restricted from direct workspace filesystem access, the orchestrator can trigger subagents that possess full filesystem and tool access.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interpolate data from the 'args' object or results from previous subagent stages directly into prompt strings for the 'agent()' function. Ingestion points: 'args' parameter and return values from 'agent()' calls as seen in SKILL.md. Boundary markers: Absent in provided documentation and examples. Capability inventory: The 'agent()' function can dispatch subagents with full workspace and tool access. Sanitization: No sanitization or escaping mechanisms are provided or encouraged in the examples.
[PERSISTENCE]: The skill explicitly instructs the agent on how to save JavaScript workflows to the '.agents/workflows/' directory to ensure they stay available across threads and future sessions, facilitating the persistence of potentially malicious logic.

run-workflow