The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes multiple scripts (badge.py, fleet_status.py, launch_profile.py, next_grid_split.py, preflight_send.py, wait_for_idle.py, broadcast.sh) that act as wrappers for the herdr CLI tool. These scripts execute shell commands using subprocess.run with the array-of-arguments format, which effectively prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill's design for orchestrating a fleet of agents creates an attack surface for indirect prompt injection, particularly during data relay and context succession.
Ingestion points: The orchestrator agent ingests data from sub-agents using the herdr agent read command in Phase 5 and processes state information via the handoff brief template in Phase 8 (defined in references/context-succession.md).
Boundary markers: While the handoff brief uses a template for organization, it lacks strict delimiters or explicit instructions for the agent to ignore or sanitize embedded instructions within the relayed data.
Capability inventory: The orchestrator has the ability to execute complex sequences of commands via the herdr CLI, including prompting agents, splitting panes, and closing windows, which could be abused if malicious instructions are ingested.
Sanitization: No specific sanitization or escaping mechanisms are implemented for the worker agent outputs before they are relayed to the user or passed to a successor agent in a handoff.

herdr-agent