The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture presents an indirect prompt injection surface because user-provided task descriptions are decomposed and passed to subagents without comprehensive sanitization.
Ingestion points: The task parameter provided by the user in the /team command (SKILL.md).
Boundary markers: The worker preamble uses structured section headers (e.g., == WORK PROTOCOL ==), but the specific subtask instructions are interpolated without unique delimiters (e.g., XML tags or security-hardened separators) to isolate them from worker instructions.
Capability inventory: Worker agents possess significant capabilities including Read, Write, Edit, and Bash tools. CLI workers (codex, gemini) have broad filesystem access (SKILL.md).
Sanitization: No explicit validation, escaping, or sanitization of the user-provided task description is documented before interpolation into agent prompts.
[EXTERNAL_DOWNLOADS]: The skill documentation references optional functionality that requires the installation of @openai/codex and @google/gemini-cli from the NPM registry. These packages are provided by well-known technology organizations and facilitate the skill's CLI worker features.

team