The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill incorporates untrusted data from user messages and subagent outputs into its decision-making and delegation process.
Ingestion points: The skill reads user messages to split them into tasks and includes the "user's exact words" in briefs for subagents. It also processes results from subagents via <task-notification>.
Boundary markers: The skill instructs that "A subagent sees nothing of this chat. The brief is all it knows," providing a logical boundary, but it lacks instructions for using physical delimiters (e.g., XML tags or triple quotes) to wrap untrusted user input within those briefs.
Capability inventory: The skill has the ability to spawn agents (Agent), send instructions to running agents (SendMessage), and execute shell commands (run_in_background: true).
Sanitization: There are no instructions to sanitize, escape, or filter user-provided strings before they are interpolated into subagent briefs, nor are there checks to ensure subagent results do not contain malicious instructions aimed at the orchestrator.
[COMMAND_EXECUTION]: The skill's instructions explicitly direct the agent to execute shell commands in the background for tasks like builds, installs, and tests. While this is a functional requirement, it establishes a workflow for executing arbitrary commands based on generated task briefs.
[PERSISTENCE]: The skill maintains state across sessions and context compactions by writing a ledger to .claude/orchestrator.md or ~/.claude/orchestrator.md. While used for tracking task status, this is a mechanism for persistent storage of agent-generated data on the host filesystem.

orchestrator