The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses forceful language in both its metadata and instructions, such as 'CRITICAL: MUST run for EVERY message' and 'MANDATORY: Always show agent banner', to override default agent behavior and force specific output formatting on every interaction.
[INDIRECT_PROMPT_INJECTION]: The skill implements a complex scoring system that analyzes user input and repository content to determine task complexity and select agents or models. This creates an attack surface where maliciously crafted data in a file or message could influence the agent's operational parameters, such as escalating to a more powerful model or triggering resource-intensive 'Team Mode'.
Ingestion points: Processes user messages, mentioned files, and project configuration files (e.g., package.json, requirements.txt) across multiple detection layers.
Boundary markers: No clear delimiters or safety instructions are provided to prevent the agent from following instructions embedded within the data it analyzes.
Capability inventory: The skill directs the agent to use the 'Task' tool to spawn sub-agents and invokes other complex skills like 'workflow-orchestrator'.
Sanitization: No evidence of input sanitization or validation of the task content patterns used for scoring.
[METADATA_POISONING]: The skill's YAML frontmatter description uses urgent, high-priority keywords ('CRITICAL', 'MUST run') to manipulate the agent platform's execution priority.

agent-detector