The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from guidance files (e.g., AGENTS.md, manifests, CI configs) found in external repositories. This establishes an attack surface where a donor repository could contain malicious instructions designed to hijack the agent's task during the cross-pollination process.\n
Ingestion points: The Intake and Research phases in SKILL.md read arbitrary files from repositories provided in the arguments to the skill.\n
Boundary markers: The skill does not define specific delimiters or "ignore embedded instructions" warnings for the external data ingested during the inventory phase.\n
Capability inventory: The skill and its orchestrator possess capabilities for file writing, package installation (via bun, uv, npm, etc.), and Git commits across multiple repositories.\n
Sanitization: Mitigation is provided by specific instructions to "Adapt rather than copy," "Rewrite each transfer for the recipient's... voice," and "Classify each candidate exactly once," which forces a human-in-the-loop or cognitive analysis step rather than raw data interpolation.\n- [COMMAND_EXECUTION]: The skill and its associated inventory script execute various system commands to analyze and modify repositories.\n
Evidence: scripts/inventory.ts uses execFileSync to run git commands and just --summary on files found within the repositories. The implementation phase in SKILL.md involves running package managers (e.g., bun add, uv add, go get) which execute code based on the inventory discovered in the donor repositories.\n
Analysis: The risk is controlled by path resolution and validation of Git roots, but the process inherently trusts the output of local CLI tools and the metadata found in repository manifests.

repo-cross-pollination