The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a 'Zero Manual Intervention' auto-discovery feature that scans the filesystem for any file named SKILL.md and automatically registers it into the agent's ecosystem.
Ingestion points: The scan_registry.py script crawls the workspace and subdirectories up to a depth of 3, reading metadata from any found skill files.
Boundary markers: Extracted metadata (name, description, capabilities) is incorporated into the registry without delimiters or instructions to ignore embedded prompts, which could allow a malicious skill to influence the orchestrator's decision-making.
Capability inventory: The orchestrator identifies and ranks skills based on these untrusted descriptions and generates execution plans for the agent to follow.
Sanitization: No integrity checks or content validation are performed on the discovered SKILL.md files before they are trusted by the registry.
[COMMAND_EXECUTION]: The workflow requires the agent to execute several local Python scripts (scan_registry.py, match_skills.py, orchestrate.py) provided with the skill. These scripts process user input and filesystem data to control the agent's tool-use strategy.
[METADATA_POISONING]: The skill's frontmatter contains a risk: safe field, which is a self-asserted safety claim that may attempt to bypass security review processes.

agent-orchestrator