The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a multi-agent orchestration architecture where a supervisor agent ingests, validates, and acts upon outputs generated by subagents.
Ingestion points: Untrusted data enters the agent context via subagent execution results (referenced in delegateTask logic) and handoff logs analyzed by the system.
Boundary markers: The protocol uses a "Manifest of Objective" to define subagent goals, but lacks explicit delimiters or instructions to treat subagent output as potentially adversarial content.
Capability inventory: The skill has the capability to execute local scripts (scripts/monitor-delegation.ts, scripts/validate-handoff.py) and utilizes the Model Context Protocol (MCP) to access external tools and databases.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the content returned by subagents before it is processed by the parent agent.
[COMMAND_EXECUTION]: The skill instructions reference and utilize local scripts for monitoring and validation purposes.
Evidence: The documentation points to scripts/monitor-delegation.ts for real-time visualization and scripts/validate-handoff.py for analyzing handoff logs.
[DATA_EXFILTRATION]: The skill uses the local file system to store and retrieve persistent execution plans, which involves accessing a hidden directory in the user's home path.
Evidence: The Conductor's Protocol and Plan-Synced Execution rules require the agent to read and write data to ~/.gemini/plans/ for session recovery and verification.

subagent-orchestrator