The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes python scripts/discover_skill.py with arguments derived from a summary of the user's task. This creates a command injection surface if the summary, which is based on user intent, contains shell-sensitive characters that are not properly escaped by the executing environment.
[DYNAMIC_EXECUTION]: The skill's primary function is to load and follow instructions at runtime that are not present in the static skill definition. By instructing the agent to "Follow the loaded skill" within specific delimiters, it creates a mechanism for dynamic instruction injection that can bypass safety filters or static analysis.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to poisoning if the discovery script retrieves instructions from untrusted sources, such as a database or local files that can be modified by an attacker. The agent is directed to obey these instructions without a clear validation step.
Ingestion points: Instructions are ingested from the stdout of scripts/discover_skill.py as described in Step 3 and Step 4 of SKILL.md.
Boundary markers: The skill utilizes ====== delimiters to separate the dynamic instructions from the main prompt.
Capability inventory: The instructions in SKILL.md direct the agent to "Follow those instructions to complete the task," which grants the dynamically loaded content access to whatever tools and permissions the agent currently possesses.
Sanitization: There is no evidence of sanitization or integrity checking of the instructions returned by the discovery script.

skill-discovery