The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses scripts/orch-idlewatch to read Claude Code session transcripts from ~/.claude/projects. This provides access to the full history of all AI interactions on the machine, which may contain sensitive credentials, code, or personal data.
[INDIRECT_PROMPT_INJECTION]: The orchestrator ingests data from external sources (GitHub PR bodies, titles) and local session transcripts to coordinate worker agents via SendMessage. The lack of sanitization or explicit boundary markers when relaying this content allows for multi-step injection attacks where a malicious external input could compromise the orchestration logic.
[COMMAND_EXECUTION]: The skill relies on several bash scripts that execute git and gh commands based on inputs from GitHub. While these are used for legitimate automation, the reliance on shell execution with external data increases the potential attack surface.
[PERSISTENCE]: The scripts/orch-iam script creates a persistent state file in ~/.local/state/orchestrate/ to track the orchestrator's identity across sessions.
[DYNAMIC_EXECUTION]: The orchestration library (scripts/orch-lib.sh) sources shell configuration files from the user's home directory (~/.config/orchestrate/*.env). This can lead to arbitrary code execution if the configuration files are manipulated or contain executable shell logic.

orchestrate-sessions