The Agent Skills Directory

[COMMAND_EXECUTION]: The skill configuration in 'references/lanes.md' specifies shell commands for the agent to use when dispatching tasks to specific model lanes. These commands include high-risk flags that modify tool behavior.
Evidence: 'Cursor CLI agent -p --force --sandbox disabled'
Evidence: 'muse exec --trust-workspace'
[PRIVILEGE_ESCALATION]: By instructing the agent to use the '--sandbox disabled' and '--trust-workspace' flags, the skill attempts to escalate the agent's effective permissions and bypass security controls designed to isolate code execution and verify workspace integrity.
Impact: Disabling the sandbox allows the code generation tool (Cursor) to potentially interact with the host system without restriction. Trusting the workspace ('--trust-workspace') bypasses safety prompts that would otherwise warn a user before executing potentially malicious code in a new directory.
[INDIRECT_PROMPT_INJECTION]: The skill manages a workflow that ingests and processes untrusted data from multiple sources, creating a surface for indirect prompt injection attacks.
Ingestion points: User-provided feature descriptions ('build X') and files generated during the process ('.hermes/specs/', '.hermes/plans/', '.hermes/tickets/').
Boundary markers: The skill uses '[NEEDS CLARIFICATION]' markers to delimit ambiguous sections, which provides some separation but is not a robust security boundary.
Capability inventory: The skill has extensive shell execution capabilities through integrated CLI tools (Cursor, Codex, Claude Code, Muse, Hermes).
Sanitization: No explicit sanitization or escaping mechanisms are described for external content interpolated into plans or tickets.

orchestrator