CodeVetter · Repo Unpack · Risk map
msitarzewski/agency-agents
The highest-impact code is install.sh, because it writes outside the repo, rewrites Hermes config, can delete a plugin directory, and can symlink the catalog into a host. Agent markdown is prompt supply chain: a merged file is copied verbatim into users' coding agents. The two slug systems and the hardcoded AGENT_DIRS copies are the main ways a catalog change silently drops or mis-addresses agents. Tests pin the identity installers well and the other hosts mostly by conversion invariants.
- install.sh writes to $HOME and $PWD by design: ~/.claude/agents, ~/.github/agents, ~/.copilot/agents, ~/.hermes, ~/.openclaw, and project .cursor/rules and .opencode/agents. --path replaces the destination with any caller-supplied directory. --link uses ln -sf, so a later edit in the clone changes the installed agent.
- install_hermes rm -rf's the destination after forcing the basename to agency-agents-router, which is meant to avoid deleting a shared plugins directory. ensure_hermes_plugin_enabled still rewrites the user's config.yaml and only warns if that Python step fails. A backup is config.yaml.bak.agency-agents-plugin.<pid>.
- install_openclaw shells out to openclaw agents list --json and openclaw agents add --workspace --non-interactive when the binary is on PATH. Failure of add is swallowed with || true.
- clean_tool_output runs find ... -exec rm -rf on integrations/<tool> children except README.md. The only guard is a ^[a-z0-9-]+$ match on the tool name so a future caller cannot pass ../. convert.sh --out can redirect that tree anywhere.
- Parallel install interpolates worker_flags unquoted: sh -c '... $AGENCY_INSTALL_EXTRA ...'. A --path value containing spaces or shell metacharacters is split. test-install.sh exists specifically because a path with a space was previously split into two destinations.
- SECURITY.md scopes the threat model to markdown prompts plus shell scripts: no secrets in agent files, no executable code inside markdown, review scripts before merge, and report agent files that attempt prompt injection via a private GitHub advisory rather than a public issue. Nothing in CI scans agent bodies for injection or exfiltration text.
- Hermes search and delegate put attacker-controlled query/task strings next to the full specialist body. _specialist_prompt tells the model to obey higher-priority instructions, but the body itself is unfiltered catalog text, and include_body returns it raw. Delegation imports agent.subagent_lifecycle from the Hermes process.
- Filename-stem IDs and name-slugs diverge. check-runbooks.sh and the desktop app use the .md basename. install.sh --agent and converters use slugify(name). engineering-frontend-developer.md is named Frontend Developer, so its installer slug is frontend-developer. Passing a runbook slug to --agent fails agent_slug_exists unless that string happens to match a name slug.
- Division lists are copied. install.sh reads divisions.json, but convert.sh and lint-agents.sh hardcode AGENT_DIRS. The comment in install.sh says a hardcoded copy previously dropped healthcare (#655/#668). check-divisions.sh is the only thing that keeps the copies aligned, and it does not parse install.sh because that file no longer has a literal division array.
- lint-agents.yml does not run on push to main and does not run at all unless a division path or the linter scripts change. A PR that only edits install.sh will not lint agents. Whole-roster lint uses github.base_ref, which the workflow only defines for pull_request.
- OpenCode silently drops agents above about 119. The installer only warns (capacity_warn, wizard footer, dry-run). It still writes every selected file. Installing the full 279-agent roster into OpenCode is a known partial failure.
- i18n localize-agents-zh.ps1 rewrites installed name and description fields in the user's Copilot directories. That mutates files install.sh just copied and can desync them from the name slug the converters computed. The script is PowerShell and is not invoked by the bash CI workflows.
- AGENCY_TUI_FORCE is a test hook that marks the TUI active and skips the TTY check, alt-screen, and stty takeover. Combined with read_key's raw mode, a forced wizard on a real terminal session is a footgun if a caller exports the variable.
- integrations/mcp-memory/setup.sh probes the user's MCP config paths and prints a sample mcpServers block, but it does not install a server. The README's remember/recall/rollback contract is documentation only; nothing in scripts/ wires those tools.