The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a callback mechanism that ingests data from external files and injects it directly into the agent's instruction stream to trigger new actions.
Ingestion points: The extension script extensions/herdr-callbacks.ts monitors the ~/.pi/agent/callbacks/ directory and reads the contents of any file ending in .done.
Boundary markers: The injected message is prefixed with a bracketed source tag (e.g., [subagent-callback:file.done]), which provides minimal separation between the system's context and the potentially untrusted external data.
Capability inventory: The parent agent possesses high-privilege capabilities including the Bash tool and the ability to control other agent processes via the herdr CLI.
Sanitization: No sanitization, escaping, or validation is performed on the content of the callback files before they are passed to the agent's steering mechanism via the pi.sendUserMessage function using the deliverAs: "steer" option.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to perform extensive system operations and process management via the command line, which could be abused if the agent is misled by subagent callbacks.
Evidence: SKILL.md directs the agent to use herdr CLI tools for pane management (herdr pane split), agent orchestration (herdr agent start/prompt), and filesystem manipulation (mkdir, cp).

herdr-subagents