The Agent Skills Directory

[PROMPT_INJECTION]: The skill scaffolds sub-agents that serve as ingestion points for untrusted data, creating a surface for indirect prompt injection.\n
Ingestion points: New agent definition files created in .claude/agents/ and subsequent user interactions with these sub-agents.\n
Boundary markers: The provided sub-agent template lacks boundary markers or instructions to ignore potentially malicious embedded commands in the data they process.\n
Capability inventory: The created agents are granted access to high-risk tools including Bash, Edit, Write, and Read as specified in the template in SKILL.md.\n
Sanitization: The instructions do not include any steps for sanitizing or validating external content before it is processed by the new agents.\n- [COMMAND_EXECUTION]: The template for new agents explicitly includes Bash in its tools list. This enables the creation of agents with shell access, allowing for arbitrary command execution. This pattern could be used to bypass the tool restrictions of the parent create-agent skill, which is limited to Write, Read, Grep, and Glob.

create-agent