The Agent Skills Directory

[SAFE]: The skill operates within its intended scope of reading other agent skill definitions to provide routing recommendations. No malicious code, obfuscation, or persistence mechanisms were detected.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests content from external markdown files to build its recommendation logic.
Ingestion points: The skill reads SKILL.md files from the repository and the ~/.agents/skills/ directory.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested files.
Capability inventory: The skill's capabilities are limited to conversational interaction and decision-making logic. It does not have access to tools for command execution, file modification, or network requests.
Sanitization: There is no evidence of sanitization or filtering of the ingested content.
Conclusion: While the attack surface exists, the lack of powerful capabilities makes this surface low risk.

ask-nova