The Agent Skills Directory

[COMMAND_EXECUTION]: The skill attempts to locate and execute the 'claude' agent binary by searching broadly across user directories (find /home -name "claude"). This practice is risky as it may execute an unauthorized or malicious binary placed in a subfolder by another user.
[PRIVILEGE_ESCALATION]: The orchestration logic explicitly spawns worker agents using the --dangerously-skip-permissions flag. This bypasses the security sandboxing and user-confirmation checkpoints designed to prevent autonomous agents from performing sensitive actions without oversight.
[INDIRECT_PROMPT_INJECTION]: The skill implements a supervision loop that monitors the output of sub-agents (herdr pane read). It is programmed to detect permission prompts (e.g., 'Do you want to proceed?') and automatically send approval keys (Down+Enter). This creates a vulnerability where an attacker-controlled file processed by a sub-agent could trick the orchestrator into auto-approving malicious actions.
Ingestion points: Visible buffer reads in Section 7 via herdr pane read.
Boundary markers: None present; the orchestrator processes the raw visible buffer.
Capability inventory: Spawning agents, sending keys to other panes, closing panes, and running commands via the herdr CLI.
Sanitization: None; the logic uses simple string pattern matching to trigger automated command injection into other panes.
[DYNAMIC_EXECUTION]: The cleanup and management scripts interpolate environment variables and CLI output directly into Python script snippets (e.g., ws_id = '$WS_ID'). This lacks proper escaping and could be exploited if an identifier returned by the system contains malicious characters designed to break the script context.

herdr-orchestrator