The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a manual routing system that directs the agent to load and execute instructions from external files based on computed relative paths.
Evidence: The instruction "Read ../<skill>/SKILL.md (a sibling of this skill's directory) and follow it as if it had been invoked."
Evidence: Explicit instruction to bypass platform tools: "When a skill hands off to another by name... load that one the same way — never through the Skill tool."
Risk: Bypassing platform-managed tool execution removes standard guardrails and telemetry, allowing the agent to execute instructions from files that may not have been explicitly vetted for the current context.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture creates an attack surface where user-controlled input could influence which file is read from the filesystem.
Evidence: The routing table maps user "Needs" to "Skill" identifiers that are interpolated into filesystem paths (../<skill>/SKILL.md).
Risk: An attacker could provide a "need" designed to trick the agent into constructing a path traversal string (e.g., using ../../ or pointing to other sensitive directories), potentially leading to arbitrary file read or the execution of malicious instructions stored elsewhere on the system.

brand