The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of the herdr CLI to perform orchestration tasks. It dynamically constructs and runs shell commands like herdr agent start, herdr agent prompt, and herdr pane split to manage worker agents across different panes and tabs.
[PRIVILEGE_ESCALATION]: The instructions in references/agent-launch.md explicitly direct the host agent to launch worker agents with posture flags that bypass security controls. Evidence includes the use of --dangerously-skip-permissions for Claude agents and --yolo --sandbox disabled for Cursor agents, which intentionally removes standard safety boundaries for sub-processes.
[INDIRECT_PROMPT_INJECTION]: The orchestration dispatch loop creates a vulnerability surface for indirect prompt injection by integrateing untrusted data from worker agents.
Ingestion points: Step 3 of the Dispatch Loop in SKILL.md reads worker agent output using herdr agent read <name> --source recent-unwrapped.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded instructions when processing this worker output, making the host agent susceptible to influence by a worker's transcript.
Capability inventory: The host agent possesses significant capabilities, including prompting other agents, creating and closing panes, and writing to the local filesystem.
Sanitization: There is no evidence of sanitization or validation of the content read from worker agents before it is integrado into the host agent's decision-making logic.
[PERSISTENCE]: The skill maintains a session ledger at ${XDG_STATE_HOME:-$HOME/.local/state}/herdr-orchestration/<run-key>.md to track active agent IDs and workstream states across the orchestration session. While used for coordination, it represents a persistent record of the run's resources on the host filesystem.

herdr-orchestration