The Agent Skills Directory

External Resource Loading: The skill is designed to fetch numerous markdown files from an external repository (github/gh-aw) to define its operational logic. While these resources appear to be part of the intended environment, loading logic from external sources is a security consideration.
Indirect Prompt Injection Surface: The skill contains a mechanism to load local repository files (e.g., .github/aw/instructions.md) which are explicitly instructed to override core defaults.
Ingestion points: Remote files from github/gh-aw and local files from the user's current repository path.
Boundary markers: The skill does not currently implement explicit boundary markers or delimiters when interpolating these instructions, and instead instructs the agent to "follow it directly."
Capability inventory: The router itself primarily performs file-read and prompt-routing operations; however, it references other skills (like otel-queries) which may have broader capabilities.
Sanitization: No explicit sanitization or validation of the loaded markdown content is performed before it is integrated into the agent's context.
Security-Conscious Plugin Policy: The instructions explicitly restrict the addition of new skills or plugins to those defined in specific metadata fields, prohibiting "on-the-fly installs." This represents a positive security practice to prevent unauthorized tool execution.

agentic-workflows