The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements architectures that ingest untrusted user prompts to be processed by LLMs, creating an attack surface for indirect prompt injection.
Ingestion points: The CompletionRequest in SKILL.md and ChatRequest in references/microservice-architecture.md structures accept a prompt field directly from API callers.
Boundary markers: The provided implementation snippets lack explicit delimiters (e.g., XML tags or special tokens) to isolate user content from system instructions.
Capability inventory: The skill environment is granted Bash(python3:*), Write, and Edit tools, which could potentially be misused if the agent obeys instructions injected into the prompt.
Sanitization: No input sanitization or validation of the prompt content is present in the reference implementations.
[COMMAND_EXECUTION]: The skill's configuration in SKILL.md explicitly permits Bash execution for Python 3 tasks. This is necessary for the provided architecture implementations (like the worker_loop) but represents a capability that must be monitored.
[EXTERNAL_DOWNLOADS]: The skill references and provides code for interacting with OpenRouter's official API (https://openrouter.ai/api/v1). These references are documented for legitimate architectural purposes and trace back to a well-known service.

openrouter-reference-architecture