The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to use the "--dangerously-skip-permissions" flag when starting worker agents via the herdr CLI. This flag is designed to bypass interactive safety prompts, which facilitates automation but reduces human oversight of worker actions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from external issue trackers (GitHub or GitLab), including issue bodies and user comments. This creates a surface for indirect prompt injection, where a malicious user could embed instructions in an issue comment to influence the behavior of the orchestrator or worker agents. Ingestion points include "gh issue view", "glab issue view", and tracker REST API calls as documented in orchestrator.md and worker.md. While the skill includes a 'Worker Contract' in references/worker.md, there are no technical delimiters used to sanitize the ingested issue content. The agents have access to git, herdr, and tracker CLIs, enabling file modification and tool execution. No explicit sanitization or filtering of the ingested tracker data is performed.
[COMMAND_EXECUTION]: The skill relies on executing complex shell commands through herdr, git, gh, and glab to perform operations like creating git worktrees, splitting terminal panes, and starting new agent processes.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes instructions to read process environment variables via "/proc/$pid/environ" to identify configuration directories such as CLAUDE_CONFIG_DIR. While used for session management, this demonstrates the capability to access sensitive process information.

orchestrate-herdr