The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from other agent panes to coordinate tasks, creating a theoretical attack surface for indirect prompt injection if an attacker can influence a shared repository or pane transcript.
Ingestion points: herdr-pair.mjs reads pane transcripts via herdr agent read in the identify function; the agent processes inbound messages starting with [agent ...] headers.
Boundary markers: The protocol relies on specific markers ([agent ...], [herdr-pair control ...]) and high-entropy conversation excerpts to distinguish caller identity.
Capability inventory: The skill executes local commands (via herdr, git, ps, openssl), manages local session files in ~/.herdr-coworkers, and sends prompts to other terminal panes.
Sanitization: The shellQuote function in herdr-pair.mjs is used to sanitize all data interpolated into shell commands, preventing command injection from processed data.
Identity Verification: A strong process-ancestry proof is implemented to ensure that agents communicate only with the verified, authorized partner pane, preventing cross-pane spoofing.

herdr-pair