The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly mandates the use of command-line flags that bypass built-in security controls, permission prompts, and sandboxes for worker agents.
In the references/agent-launch.md file, the skill configures the claude agent with the --dangerously-skip-permissions flag, which is described as bypassing all permission checks.
The cursor agent is configured with the flags --yolo --sandbox disabled, which force-allows commands and removes environment isolation.
SKILL.md instructs the agent to use these flags for every worker in the run, effectively granting sub-agents autonomous and unrestricted access to the host system.
[COMMAND_EXECUTION]: The skill relies on extensive execution of the herdr CLI and various agent binaries to manage tabs, panes, and worker lifecycles.
SKILL.md contains numerous shell command patterns for creating workspaces (herdr tab create), running agents (herdr agent start), and interacting with process output (herdr agent read).
[INDIRECT_PROMPT_INJECTION]: The orchestration workflow establishes an attack surface where a compromised worker agent could influence the host agent's behavior during the integration phase.
Ingestion points: The host agent (Control Tower) is instructed to read results and status from workers using herdr agent get and herdr agent read (SKILL.md, Step 3 & 4).
Boundary markers: The instructions lack specific requirements for using delimiters or boundary markers when processing worker-generated text, which could contain hidden instructions.
Capability inventory: The host agent possesses significant capabilities, including the ability to split panes, execute arbitrary shell commands via sub-agents, and modify the local file system during output integration.
Sanitization: The dispatch loop (Step 4) requires the host to "Integrate accepted output" and "resolve interactions" but provides no guidance on sanitizing or filtering instructions embedded in that output.

herdr-orchestration