The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes orchestration patterns like 'Fan-out & synthesize' and 'Adversarial verification' where data processed by sub-agents is passed between steps. This creates a surface for indirect prompt injection if sub-agent outputs are treated as trusted instructions in the next stage of the pipeline.
Ingestion points: Task descriptions and results from sub-agents (e.g., 'Review' findings) are processed in subsequent stages (e.g., 'Verify' or 'Synthesize') in SKILL.md.
Boundary markers: The skill suggests using a schema to force structured output, which provides a data boundary but does not fully mitigate malicious instruction injection within those fields.
Capability inventory: The orchestrated sub-agents have the capability to write to the filesystem and execute tasks across the repository.
Sanitization: The skill recommends 'Adversarial verification' as a quality pattern to refute findings, but lacks explicit programmatic sanitization for interpolated prompt data.
[DYNAMIC_EXECUTION]: The core purpose of the skill is to enable Claude to generate and execute JavaScript scripts at runtime to orchestrate sub-agents. While this is the intended functionality of the platform feature, runtime code generation and execution represent a significant capability that can be exploited if the generated script incorporates untrusted input.
[PRIVILEGE_ESCALATION]: The documentation explicitly warns that sub-agents launched via workflows operate in an acceptEdits mode by default. This mode bypasses the standard interactive confirmation prompts for file modifications, granting the AI autonomous write access to the filesystem regardless of the user's current session settings.

dynamic-workflows