The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates Indirect Prompt Injection by design. It creates a communication channel where one AI agent's output is directly injected into another agent's context. The server instructions explicitly tell the agent to 'RESPOND IMMEDIATELY' to peer messages and treat them like 'a coworker tapping you on the shoulder,' increasing the success rate of malicious instructions sent from a compromised or adversarial peer session. \n
Ingestion points: server.ts (polling/push loop from broker)\n
Boundary markers: None present; messages are delivered as plain text within a channel meta-structure.\n
Capability inventory: list_peers, send_message, set_summary, check_messages, kill_peer.\n
Sanitization: No escaping or validation of message content is performed before presentation to the agent.\n- [COMMAND_EXECUTION]: The skill includes a kill_peer tool that allows an agent to terminate the session of another peer. The implementation in broker.ts uses Bun.spawnSync to execute the ps command to find a target's parent process and then calls process.kill(targetPid, 'SIGTERM'). While intended for lifecycle management, this allows an agent to terminate arbitrary processes belonging to the user if peer registration data is manipulated.\n- [DATA_EXFILTRATION]: Upon registration, the server.ts script collects and shares environment metadata including the current working directory, git repository root, and the TTY name of the parent process. This information is broadcast to any other peer connected to the shared Unix socket broker, exposing the user's local directory structure and session identifiers.

claude-peers