The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill configuration and documentation default to and recommend the use of the --dangerously-skip-permissions flag when launching sub-agent Claude sessions. This flag bypasses the platform's security confirmation dialogs for tool usage (such as shell command execution, file reading, and file writing), granting the agents full autonomy to perform operations without human oversight.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains several dynamic command injections using the !command syntax that execute automatically when the skill is loaded. These commands include pgrep to monitor processes, cat to read the worktree registry, and memory_pressure to check system resources. While the current commands are used for status reporting, the mechanism allows for silent load-time code execution.
[INDIRECT_PROMPT_INJECTION]: The skill operates as a coordination layer that ingests external data, creating an attack surface for indirect prompt injection. Ingestion points: The team lead agent reads external state from git log output on agent-managed branches, .agent-status files written by sub-agents, and the worktree-registry.json file. Boundary markers: The skill encourages the use of focused prompts and file boundaries in WORKTREE_TASK.md, but it lacks explicit instruction delimiters or sanitization protocols for the orchestrating agent when processing these external logs and status files. Capability inventory: The skill has the ability to spawn new agent sessions, write to the filesystem, and perform git merge operations. Sanitization: There is no documented validation or escaping of the content found in commit messages or status files before it is processed by the orchestrating lead agent.

agent-teams-skill