The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The "Agent Spawn Protocol" (Section 3) mandates the use of TypeName="self" for all sub-agent invocations. This ensures that every sub-agent in the hierarchy inherits full "write, execution, and subagent tools" from the parent coordinator. This design results in significant privilege propagation, where even specialized sub-agents possess broad system access capabilities (command execution, file modification) that may exceed their specific functional requirements.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture is highly susceptible to indirect prompt injection due to its reliance on external workspace files for behavioral logic.\n
Ingestion points: Section 3 instructions mandate that agents read role definitions from .agents/agents/{agent-type}.md as their first action. Task-specific instructions are ingested from .agentwork/brief.md.\n
Boundary markers: The protocols lack requirements for boundary markers or delimiters to isolate potentially untrusted task content from the agent's core instructions.\n
Capability inventory: Agents governed by these protocols are granted powerful capabilities, including invoke_subagent (for dispatch), file system writes, and shell command execution.\n
Sanitization: No provisions for sanitizing or validating the content of the role files or task briefs are described, meaning an attacker with write access to these files could inject malicious instructions that the agent would treat as authoritative.\n- [COMMAND_EXECUTION]: The protocol explicitly enables and encourages the use of command execution tools across the multi-agent hierarchy. Section 3 confirms that sub-agents inherit "command execution" tools, and Section 6 encourages delegation of work that typically involves shell-based operations like running tests or quality checks.

agent-protocols