The Agent Skills Directory

[PROMPT_INJECTION]: The orchestration framework is vulnerable to indirect prompt injection because it lacks isolation between data and instructions when passing information between agents.
Ingestion points: The build_user_prompt function in orchestrator-template.sh reads untrusted data from state/queue/plan.json and text files in state/handoffs/ to construct prompts for downstream agents.
Boundary markers: While the system uses tags for extracting data, it does not use security delimiters or specific instructions (e.g., 'treat the following as untrusted data') to isolate injected content from instructions.
Capability inventory: The pipeline uses the claude CLI, which can execute tools and access external systems via MCP, increasing the potential impact of a subverted agent.
Sanitization: The skill provides no mechanism for sanitizing, escaping, or validating the content produced by agents before it is reused in the pipeline.

multi-agent-orchestration