The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a multi-agent architecture where a 'root' agent manages several autonomous 'child' agents. This setup introduces an attack surface where malicious instructions could be passed from a child agent to the root agent.
Ingestion points: The root agent receives task updates, questions, and completion reports from child agents through the intercom tool (e.g., intercom({ action: "send", ... })).
Boundary markers: There are no specified delimiters or instructions for the root agent to ignore potential prompt injections embedded in the messages received from child agents.
Capability inventory: The root agent possesses significant capabilities, including file system operations via git and wt, terminal workspace management via herdr and tern, and repository interaction via the gh CLI.
Sanitization: The instructions do not define a process for sanitizing or validating the content of messages received from child agents before they are processed by the root agent or relayed to the user.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands to orchestrate the development environment and manage child agent lifecycles.
Evidence: Extensive use of git, wt (worktree), herdr, and tern CLIs to create workspaces, split panes, and manage sessions across different terminal environments.
Evidence: The skill uses tern send <block> paste "$(cat /tmp/ho-<feature>-<task>.md)" to dynamically read and transmit instruction files between terminals.
[EXTERNAL_DOWNLOADS]: The skill instructions include a step to install an external plugin for the agent platform.
Evidence: It suggests running omp plugin install pi-intercom if the communication tool is missing.

kstack-handoff