The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to launch multiple sub-agents using the --dangerously-skip-permissions flag. This flag is designed to bypass the standard human-in-the-loop confirmation prompts for tool usage within the agent environment, granting the sub-agents full autonomy to modify files and execute commands without user review.
[DYNAMIC_EXECUTION]: Under the 'Learn — update this skill' section, the agent is instructed to modify its own SKILL.md file after completing tasks. This creates a self-modification loop where the agent updates its own rules and logic based on its observations, which could be used to persist unintended or malicious instructions across future sessions.
[INDIRECT_PROMPT_INJECTION]: The orchestrator agent processes summaries and status reports from sub-agents, creating a vulnerability surface where a compromised sub-agent could influence the orchestrator's behavior through its output.
Ingestion points: The orchestrator reads sub-agent transcripts using herdr pane read <pane-id> --source recent-unwrapped --lines 200 to extract summaries.
Boundary markers: No specific boundary markers or schema validations are defined to isolate the sub-agent's summary from the orchestrator's logic.
Capability inventory: The orchestrator possesses the capability to execute shell commands, manage git repositories via worktrees, and perform arbitrary file system writes.
Sanitization: There is no sanitization or verification of the information received from sub-agents before it is used to guide the orchestrator's next actions.

herdr-goal