The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill orchestrates pipelines where agent prompts are constructed by interpolating outputs from previous steps (e.g., {{steps.research.output}} in references/examples.md). This creates an attack surface where a sub-agent interacting with external data, such as web search results, could pass malicious instructions to downstream agents.
Ingestion points: Data enters the context via inputs and the output of preceding workflow steps, as defined in references/workflow-schema.md and references/execution-engine.md.
Boundary markers: The templates provided in references/examples.md interpolate variable data directly into prompts without explicit delimiters or "ignore embedded instructions" warnings.
Capability inventory: The orchestrator grants sub-agents access to high-privilege tools including Bash, Write, and Agent.
Sanitization: The references/execution-engine.md describes validation for schema, rules, and types, but does not specify sanitization or escaping of content to prevent prompt injection.
[DYNAMIC_EXECUTION]: The orchestrator supports generating and running workflows derived from natural language descriptions. According to SKILL.md, while the system is designed to show the generated YAML for user approval before execution, this pattern relies on the user's ability to verify the safety of the complex execution DAG and agent prompts at runtime.
[COMMAND_EXECUTION]: The Bash tool is enabled and utilized by agents in example workflows (e.g., researcher and intent_scorer in references/examples.md). The execution engine resolves variable templates directly into these agent prompts, creating a potential path for command injection if the inputs or intermediate outputs are not strictly validated before being processed in a shell environment.

sub-agent-orchestrator