The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions explicitly recommend using the --dangerously-skip-permissions flag when invoking sub-agents. This practice bypasses built-in security prompts, allowing the agent to perform actions without explicit user confirmation.
[REMOTE_CODE_EXECUTION]: The skill configuration and instructions rely on the execution of Python scripts (agent_orchestrator.py and swarm_run.py) that reside outside the skill's root directory via relative paths (../../../scripts/). This creates a dependency on external code that is not contained within the skill's own distribution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it accepts untrusted user triggers to determine complex routing logic and generate downstream task packets.
Ingestion points: Untrusted user input enters the workflow through the primary 'trigger' assessment described in SKILL.md.
Boundary markers: There are no defined delimiters or instructions to treat user triggers as untrusted data when generating planning artifacts.
Capability inventory: The orchestrator has powerful capabilities including Bash execution, Read/Write file access, and the ability to spawn and control sub-agents.
Sanitization: The instructions lack any requirement for input validation or escaping before user-provided content is incorporated into task packets.

orchestrator