The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external skills from a wide variety of third-party repositories using npx skills add <URL>.
Fetches configurations and skills from well-known sources including GitHub repositories owned by Vercel, Google, Anthropic, Stripe, Cloudflare, Expo, and Resend.
Also directs the agent to download skills from multiple unverified personal repositories (e.g., github.com/oldwinter/skills, github.com/obra/superpowers, github.com/wshobson/agents, github.com/sickn33/antigravity-awesome-skills).
[REMOTE_CODE_EXECUTION]: Installing and executing skills from unverified third-party repositories presents a significant risk, as these external files may contain malicious instructions or shell commands that are executed by the agent.
[COMMAND_EXECUTION]: The instructions explicitly direct the agent to execute shell commands such as npx skills add and npx skills find to manage the installation of external components.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: Reads project context files such as GEMINI.md, CLAUDE.md, AGENTS.md, .cursorrules, and CONVENTIONS.md from the project root.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within these external files are provided.
Capability inventory: The agent has the capability to execute shell commands (npx skills), read/write files, and download remote content.
Sanitization: There is no evidence of sanitization or validation of the content read from these configuration files before it influences the agent's routing decisions or installation actions.
[PROMPT_INJECTION]: The skill contains a self-modification instruction in the 'Pending Review' section, directing the agent to append newly discovered skills to the file. This could be exploited by an attacker who influences the agent's session to permanently inject malicious skill URLs into the router's source for future sessions.

skills-router