The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function involves executing local shell commands via the herdr and kstack CLI tools to manage processes, file system isolation (Git worktrees), and branch operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured 'result packets' (Markdown data) generated by independent worker agents. This creates a vulnerability surface where a worker agent's output could attempt to manipulate the orchestrator's behavior.
Ingestion points: Data is ingested from worker results as described in SKILL.md (Section 6, 'Verify and synthesize') and the 'Result packet' section of references/worker-contracts.md.
Boundary markers: The skill uses unique completion tokens (e.g., KSTACK_RESULT_<unique-token>) to mechanically identify the end of a worker's output, which mitigates but does not fully prevent injection via the content itself.
Capability inventory: The orchestrator possesses significant capabilities, including filesystem modification via Git, process management through herdr, and the ability to spawn new agent instances.
Sanitization: The skill instructions do not specify sanitization or escaping of the ingested Markdown content before the LLM processes it for synthesis.

kstack-orchestrator