The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user input through the $ARGUMENTS variable and passes it to sub-agents within the references/worker-prompt.md template. Although this creates an injection surface, the risk is addressed through several design choices:
Ingestion points: User request captured in SKILL.md and passed to references/worker-prompt.md.
Boundary markers: The TASK header is used in the worker prompt, though it lacks strict delimiters.
Capability inventory: Sub-agents are restricted to read-only tools and prohibited from performing write operations.
Sanitization: The 'slug shield' mechanism in references/hosts.md prevents raw model identifiers from leaking into the prompt context, which protects against certain types of model-steering attacks.
[COMMAND_EXECUTION]: The skill uses platform-native sub-agent tools to perform its function. The instructions explicitly forbid these workers from executing commands that modify the file system, install packages, or start servers, mitigating privilege escalation or persistence risks.

opinion