The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download skill definitions and plugin components from an external, third-party GitHub repository.
Evidence: curl -o .claude/skills/context-fundamentals.md https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/context-fundamentals/SKILL.md in SKILL.md.
Evidence: Plugin marketplace references pointing to muratcankoylan/Agent-Skills-for-Context-Engineering in SKILL.md.
[PROMPT_INJECTION]: The skill contains logic patterns for ingesting and processing untrusted external data (messages, tasks, responses), which establishes an indirect prompt injection attack surface.
Ingestion points: Untrusted data is ingested via the messages list in functions like compress_with_summary and organize_context, the task parameter in OrchestratorAgent.process_task, and the response string in score_response (all in SKILL.md).
Boundary markers: The provided code examples typically use simple f-string interpolation (e.g., f"Summarize these messages concisely:\n{to_compress}") without clear delimiters or instructions to disregard embedded commands.
Capability inventory: The skill demonstrates capabilities for file system access (Path, open), network communication (requests, anthropic), and external tool execution via Modal in SKILL.md.
Sanitization: No explicit content sanitization, escaping, or validation logic is present for data being interpolated into agent prompts.

agent-skills-context-engineering