The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a broadcaster that extracts descriptions and trigger words from various skill files and writes them into AGENTS.md context files throughout the workspace. This mechanism allows a single malicious skill to inject instructions that are then automatically distributed to other projects within the repository, potentially hijacking the agent's behavior when it operates in those contexts. Ingestion points: The scripts/analyze_skills.py script (lines 14-60) parses the content of all SKILL.md files located in the .opencode/skills/ directory. Boundary markers: The skill does not wrap the extracted text in delimiters or include explicit instructions for the agent to ignore embedded commands within the generated files. Capability inventory: The scripts/generate_agents.py script (lines 160-205) has the capability to write or append to markdown files in every directory it discovers during a recursive workspace walk. Sanitization: There is no evidence of sanitization, escaping, or validation of the metadata extracted from the source skills before it is written to the destination context files.

opencode-agent-file-generator