The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator identifies and utilizes 'Desktop Commander' as an available connector, which provides capabilities for local file system access, terminal operations, and process management.
[DATA_EXFILTRATION]: The skill architecture is designed to aggregate data from highly sensitive personal and business services (including Gmail, Google Drive, QuickBooks, and iMessage) and pass this data into a processing chain of other skills. This creates a pipeline where sensitive information is moved between potentially untrusted skill contexts.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from external connectors and local skill files which it then follows as instructions.
Ingestion points: Untrusted data enters the context via SKILL.md files in the available_skills directory and live data streams from MCP connectors (Gmail, Drive, Notion, Wix, etc.).
Boundary markers: The orchestration logic does not specify the use of delimiters or 'ignore embedded instructions' warnings when passing data between execution phases.
Capability inventory: The skill possesses broad capabilities including file reading (via the view tool), script execution ('run bundled scripts'), and terminal access (via 'Desktop Commander').
Sanitization: There is no evidence of sanitization, validation, or escaping of ingested external content before it is interpolated into the prompts of subsequent skills in the chain.

superpowers-orchestrator