The Agent Skills Directory

Indirect Prompt Injection Surface: The skill distills a brief from potentially untrusted conversation history and user-provided arguments in SKILL.md. This distilled content is then passed to delegated sub-agents for review. If the source conversation contains malicious instructions, there is a risk they could be included in the brief and influence sub-agent behavior.
Ingestion points: Live conversation history and the $ARGUMENTS parameter.
Boundary markers: The skill specifies context_depth="none" for delegated agents to prevent them from accessing the broader chat history, and requires the creation of a "self-contained REVIEW BRIEF".
Capability inventory: The skill utilizes the delegate tool to spawn sub-sessions and execute the review process.
Sanitization: The distillation phase acts as a curation step performed by the AI, though no programmatic filtering or sanitization of the input text is documented.
Dynamic Dependency Loading: The skill dynamically loads and executes external sub-skills, such as outcomist and intent-keeper, from local paths and vendor bundles (e.g., microsoft/amplifier-bundle-skills). This behavior is a core part of the orchestrator's functionality but involves the execution of instructions sourced from external skill files at runtime.

product-council-here