The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary purpose is to launch and manage background agent CLI sessions (e.g., Claude, Codex, Gemini) in 'full-auto' mode. It explicitly uses flags like --dangerously-skip-permissions, --dangerously-bypass-approvals-and-sandbox, and --yolo to suppress human-in-the-loop safety checks for these sub-agents.
[DYNAMIC_EXECUTION]: The orchestrate.sh script dynamically sources agent profile files from the $ORCH_HOME/profiles/ directory and the script's local directory using the shell source (.) command. If an attacker gains write access to these locations, they could achieve arbitrary code execution when the skill is loaded or a worker is spawned.
[INDIRECT_PROMPT_INJECTION]: The skill uses a specific text sentinel (>>> NEEDS_HUMAN:) to detect when a background worker requires user intervention. Because the skill monitors the raw TUI output of these workers (which may be processing untrusted external data, such as file content or web pages), an attacker could embed this sentinel in a file to trick the orchestrating agent into halting execution or surfacing deceptive prompts to the user.
Ingestion points: Background worker TUI screen captures obtained via tmux capture-pane or cmux read-screen (found in orchestrate.sh).
Boundary markers: The skill attempts to use line-start anchoring as a boundary marker, but this is insufficient to prevent an adversary from triggering the sentinel within processed data.
Capability inventory: The orchestrator has full control over the tmux/cmux sessions and the lifecycle of the sub-agent processes.
Sanitization: The script performs ANSI escape sequence stripping but does not sanitize or escape the sentinel sequence itself before evaluating it against the agent's logic.

orchestrate