The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The orchestrator framework allows agents to pass data to one another, creating a surface for indirect prompt injection. In the Agent.execute method in SKILL.md, external input and context are appended to the system prompt. While JSON.stringify is used to format the context, there are no explicit boundary markers or instructions for the LLM to ignore potentially malicious commands embedded in the data (e.g., content scraped from the web by a research agent).
Ingestion points: Agent.execute, SequentialOrchestrator.execute, and SupervisorOrchestrator.execute in SKILL.md all process external or agent-generated strings.
Boundary markers: None present in the buildSystemPrompt implementation.
Capability inventory: The agents utilize ChatOpenAI for reasoning, ioredis for shared memory, and provided tools like searchTool and webScrapeTool (referenced in specialists.ts).
Sanitization: No explicit sanitization or filtering of external data is performed before prompt interpolation.
[DYNAMIC_EXECUTION]: The SupervisorOrchestrator in SKILL.md uses JSON.parse on the string output returned by the supervisor LLM to determine the next agent and task. While this is a common pattern for structured output, it introduces a dependency on the LLM's output integrity. If the supervisor agent were influenced by malicious instructions in the task history, the parsed JSON could be used to manipulate the workflow execution flow.

ai-agent-orchestrator