The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands using the herdr CLI to manage workspaces and agents.
Evidence: herdr tab create, herdr pane process-info, herdr agent start, and herdr pane run are used throughout the On Herdr section in SKILL.md.
Risk: The skill builds command lines using variables like <name> and <flags> which may be derived from user input or session history. If these are not sanitized, it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest potentially untrusted data from external sources and use it to influence future agent actions.
Ingestion points: The agent is instructed to read session history and visible screen content via herdr agent read <name> --source visible (found in SKILL.md).
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing the handoff content or screen reads.
Capability inventory: The skill has significant capabilities, including file system writes (temporary directory), clipboard access (pbcopy), and arbitrary command execution via the herdr toolset.
Sanitization: While there is a natural language instruction to "Redact secrets and personal information," there is no technical validation or escaping mechanism for the ingested data before it is used in subsequent commands or prompts.
[DATA_EXPOSURE]: The skill saves session summaries, which may contain sensitive context, to the OS temporary directory and the system clipboard.
Evidence: SKILL.md instructions: "Save the handoff as Markdown to a unique file in the OS temporary directory. Copy the same text to the clipboard (pbcopy on macOS)".

handoff