The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to integrate "returned evidence" from delegated agents into its primary context, which creates a surface for indirect prompt injection if the delegated agents' outputs are influenced by malicious data.
Ingestion points: SKILL.md describes a workflow that integrates "returned evidence" and "evidence" into the orchestrator's decision-making process.
Boundary markers: The instructions do not specify the use of delimiters or provide directives to ignore or sanitize embedded instructions within the integrated evidence.
Capability inventory: The skill possesses capabilities to select models, delegate tasks to "leaf agents," and implement changes or fixes based on the integrated outcomes.
Sanitization: No sanitization, validation, or filtering mechanisms for the data returned by external agents are mentioned in the provided instructions.
[DATA_EXFILTRATION]: The references/provenance.md file contains multiple absolute local file paths (e.g., /Users/callumflack/Workspaces/Personal/repos/kb-2026/...). This exposure reveals the specific directory structure and username of the author's workstation, which can be utilized for targeted reconnaissance or path-based attacks if the agent attempts to access these locations.

orchestrate-astra