The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions granting the agent 'standing authority' to spawn teammates and manage workflows without per-action user confirmation. It explicitly tells the agent that the 'user does NOT have to say "create coder + reviewer"... just do it', which attempts to override standard agent-user interaction guardrails.
[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/sync.py) to manage agent versions. Furthermore, the tester role is instructed to discover and execute commands directly from the repository's task runners and manifests (e.g., package.json scripts, Taskfile.yml, Makefile, CI job definitions), which involves executing potentially untrusted code found in the project being analyzed.
[PRIVILEGE_ESCALATION]: The instructions explicitly expand the agent's operational autonomy by asserting authority over the subagent lifecycle, including spawning, backgrounding, and recycling teammates, without requiring individual user approval for these actions.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect prompt injection. It ingests untrusted data from the repository (build manifests, CI job definitions, CLAUDE.md, CONTRIBUTING.md) and interpolates this content into the prompts generated for subagents in the .claude/agents/ directory.
Ingestion points: Probes repository root and subdirectories for manifests, task runners, CI configs, and project documentation (SKILL.md, Step 1).
Boundary markers: Uses a ## For this repo heading to separate generic prompt bodies from repository-specific data, but this does not prevent malicious instructions in the discovered data from influencing subagent behavior.
Capability inventory: The skill uses Agent() spawning, Bash execution, and Write/Edit tools across its roles.
Sanitization: The sync.py script uses yaml.safe_load, but the prompt generation process copies discovered repository strings into agent definitions without significant sanitization.
[DYNAMIC_EXECUTION]: The skill dynamically generates subagent definitions and workflow manifests at runtime based on signals discovered in the repository. It also uses the Agent() tool to dynamically spawn and manage sub-processes (teammates) with varied roles and tiers.

agent-team