The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests data from multiple subagents, creating a vulnerability surface for indirect prompt injection.
Ingestion points: The orchestrator reads results from research agents (Explore) and implementation agents (general-purpose), specifically the findings, evidence, summary, and verification fields.
Boundary markers: The instructions lack explicit requirements for the orchestrator to use delimiters or specialized parsing to isolate untrusted subagent output from its own internal reasoning and instruction flow.
Capability inventory: The skill has extensive capabilities, including direct file writing, executing shell commands via ai-coord and gh, and spawning further subagents.
Sanitization: No sanitization, validation, or escaping of subagent-provided content is defined before the data is integrated into the final execution plan or report.
[DATA_EXFILTRATION]: The skill instructs the agent to bypass platform visibility controls by directly reading files from the internal configuration directory ~/.claude/skills/. This allows the agent to access and process the source code of companion skills that may have been intentionally hidden or restricted using the disable-model-invocation: true flag.
[COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands using external tools such as ai-coord and the GitHub CLI (gh). Command parameters like plan slugs, labels, and file paths are derived from task descriptions and subagent outputs, which may lead to command injection if malicious input is introduced through these sources.
[PROMPT_INJECTION]: The skill uses the $ARGUMENTS placeholder to interpolate user input directly into its core instructions without providing specific guidance on how the agent should sanitize or treat this data as untrusted.
[DYNAMIC_EXECUTION]: The skill manages the lifecycle of multiple subagents by dynamically generating prompts and launching them through the Agent tool using the general-purpose and Explore types.

claude-handoff