The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions require the agent to launch worker TUIs using the --dangerously-skip-permissions flag for Claude and the --yolo flag for Codex. These flags are explicitly designed to bypass the per-action security confirmation prompts that usually serve as a safety barrier, allowing workers to execute potentially dangerous tools or commands without interactive human approval.
[INDIRECT_PROMPT_INJECTION]: The orchestration flow creates a vulnerability where the controller agent processes data generated by worker TUIs.
Ingestion points: Untrusted worker output enters the agent's context through rtk herdr pane read and rtk herdr agent read commands documented in SKILL.md and references/plan-mode.md.
Boundary markers: The skill suggests using 'delegation packets' for objective definition, but lacks strict structural delimiters to prevent worker output from being interpreted as controller instructions.
Capability inventory: The agent possesses full control over the herdr socket, enabling workspace management, tool execution via workers, and filesystem interaction.
Sanitization: The skill relies on manual human or controller verification (reviewing diffs, re-running test commands) rather than automated filtering or sanitization of external content.
[COMMAND_EXECUTION]: The skill extensively uses the rtk herdr CLI suite to manage complex terminal environments. This includes the ability to send automated keyboard sequences (e.g., shift+tab, enter) and raw prompt text to interactive processes, which allows for sophisticated but potentially difficult-to-monitor execution chains across multiple agent sessions.

herdr-orchestration