The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (the 'request to route') to determine which skill should handle a task, creating a surface for indirect prompt injection where a malicious request could attempt to influence routing logic.
Ingestion points: Untrusted data enters the context via the user's original request provided as input to the /route command (SKILL.md).
Boundary markers: Absent. The instructions do not specify delimiters or specialized formatting to isolate the user's request from the routing instructions.
Capability inventory: The skill utilizes shell-based tools including jq for JSON processing and git show for retrieving documentation (SKILL.md).
Sanitization: The skill uses jq --arg for variable interpolation, which is a recommended practice to prevent command and query injection.
[COMMAND_EXECUTION]: The skill instructions include bash commands using jq to query the local skills/catalog.json file and git show to access specific documentation commits. These commands are executed locally within the agent's environment to support the routing logic.

route