The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically generates and executes Python scripts and shell commands to manage session state and inter-agent communication.
Evidence: In SKILL.md, the 'Sending (with verify)' section uses a Python heredoc (`python3
... <<'PY'`) to perform atomic JSON updates to a session file.
Evidence: Uses the herdr CLI to perform sensitive operations such as pane run (spawning new processes), pane send-text (injecting content into other panes), and pane send-keys (simulating keyboard input like 'Enter').
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automatically triggers and processes instructions based on specific patterns detected in the terminal output.
Ingestion points: The skill monitors agent terminal input for a header prefix [agent <name> -> <name> ...] as defined in the SKILL.md frontmatter and 'Receiving' section.
Boundary markers: The protocol uses a structured header but does not include explicit instructions to ignore or sanitize potentially malicious instructions embedded within the message body.
Capability inventory: The skill utilizes the herdr CLI (split, run, send-text, send-keys, read) and performs file writes to ~/.herdr-coworkers/ for state management.
Sanitization: The 'Receiving' logic in SKILL.md validates the session ID (sid) and workspace ID against a local JSON file, which mitigates some session hijacking risks but not the content injection itself.

herdr-pair