The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-model synthesis workflow where output from several external LLMs is aggregated and passed to a 'general-purpose' subagent for analysis. This creates a surface where malicious instructions embedded in a model's response could influence the subagent's behavior.
Ingestion points: The synthesis subagent reads individual model responses from files stored in <output-dir>/individual/*.md (referenced in SKILL.md).
Boundary markers: The subagent prompt uses simple text headers (e.g., 'Individual model responses:') to delimit untrusted content but lacks explicit 'ignore embedded instructions' warnings.
Capability inventory: The subagent is specified as 'general-purpose', which typically grants it access to the full suite of agent tools, including shell execution.
Sanitization: There is no evidence of sanitization or filtering of the model responses before they are processed by the synthesis subagent.
[EXTERNAL_DOWNLOADS]: The skill downloads and uses several standard AI SDKs and libraries from well-known service providers to facilitate communication with OpenAI, Anthropic, Google, xAI, and Mistral.
Evidence: Dependencies in package.json include @ai-sdk/anthropic, @ai-sdk/google, @google/genai, and openai. All are well-known, legitimate packages from established technology companies.
[COMMAND_EXECUTION]: The skill uses local shell commands for desktop notifications and to manage its internal environment.
Evidence: scripts/notify.ts utilizes child_process.execSync to trigger terminal-notifier. The script includes basic security measures such as character escaping for arguments to mitigate simple command injection attempts.

ask-many-models