The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes output from other AI agents (transcripts and status reports), which introduces a surface for indirect prompt injection. However, it implements strong mitigations including mandatory independent reviews where a 'fresh' agent context verifies results, and a requirement to validate worker outputs directly against the original user instructions.
Ingestion points: Worker transcripts accessed via herdr agent read, pane output via herdr pane read, and reports received through the orchestrator prompt.
Boundary markers: Utilizes explicit status prefixes (e.g., DONE, BLOCKED, STATUS) and assigned worker names for attribution to distinguish between different data sources.
Capability inventory: Access to the file system via git, agent lifecycle control via herdr, and pull request management via gh CLI.
Sanitization: Instructs the agent to build prompts in shell variables using quoted heredocs to prevent shell expansion of untrusted task or report text.
[DYNAMIC_EXECUTION]: The skill dynamically generates task prompts and monitoring reports ('nudges'). This is managed through instructions that enforce strict shell quoting to prevent command injection during the assembly of these instructions.
[COMMAND_EXECUTION]: The skill and its accompanying monitoring script (scripts/herdr-orchestrator-observer.sh) use standard CLI tools such as git, gh, jq, awk, and shasum. These operations are transparent, well-validated within the script, and aligned with the primary purpose of managing a development environment.
[DATA_EXFILTRATION]: The skill includes proactive instructions to prevent data exposure, specifically forbidding the inclusion of internal infrastructure identifiers like hostnames, IP addresses, or internal mount paths in repository artifacts, PR bodies, or commit messages.

shunk031-herdr-orchestrate-workers