The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts scripts/spawn_subagent.sh and scripts/send_command.sh allow the parent agent to launch any shell command and interact with the standard input of tmux windows. This provides an unrestricted interface for command execution within the user's session.
[INDIRECT_PROMPT_INJECTION]: The recommended workflow involves the parent agent reading the contents of files generated by subagents (e.g., in /tmp/). This exposes the parent agent to instructions potentially hidden in untrusted data produced by external sub-processes.
Ingestion points: Reading files produced by subagents as described in the SKILL.md workflow (step 4).
Boundary markers: Absent; the instructions do not recommend using delimiters or specific 'ignore' blocks when reading and processing subagent data.
Capability inventory: Subprocess execution via tmux scripts, file system access, and the broad capabilities of the Devin CLI agents being orchestrated.
Sanitization: Absent; the content is intended to be read directly from the filesystem without validation, escaping, or filtering.
[PRIVILEGE_ESCALATION]: The skill documentation and scripts (SKILL.md, scripts/spawn_subagent.sh) default to spawning subagents with the --permission-mode dangerous flag. This explicitly configures the agents to bypass standard security prompts for their actions, escalating their operational autonomy and increasing the impact of potential misuse.

tmux