The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting project files and configuration (like GEMINI.md) to decompose tasks into sub-agent missions. This architecture is susceptible to indirect prompt injection, where malicious instructions placed within the files being processed could manipulate the orchestrator's planning and delegation logic.
Ingestion points: The skill reads arbitrary source code files, .env.example files, and project-specific documentation (e.g., GEMINI.md) as documented in SKILL.md and examples/nextjs-feature.md to define sub-agent scopes.
Boundary markers: It employs structural markers such as MISSION BRIEF and AGENT CONTEXT PACKET to organize sub-agent instructions. While these provide structure, they do not inherently sanitize or isolate instructions found within the ingested data from the orchestrator's decision-making process.
Capability inventory: The skill is designed to coordinate file reads/writes and multiple tool-enabled agents across different models (Gemini Flash, Claude Sonnet) using the host platform's delegation mechanisms as described throughout SKILL.md.
Sanitization: The instructions do not specify sanitization, escaping, or validation of external content before it is interpolated into sub-agent prompts.
[COMMAND_EXECUTION]: The skill includes a Node.js script (scripts/install.js) designed to install the skill to the user's local agent directory.
Evidence: The installer performs directory creation and file copying. It includes defensive programming measures such as refusing to follow symbolic links in the installation path and ensuring files are not silently overwritten via the COPYFILE_EXCL flag, minimizing the risk of path traversal or unintended file corruption.

subagent-orchestrator