The Agent Skills Directory

[SAFE]: The skill is designed as a read-only exploration tool that analyzes repository content to provide high-level architectural explanations. It contains explicit instructions that prohibit editing code or publishing findings outside the current conversation.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted repository content (source code and configuration files such as .agents/agent-models.md) and interpolates it into subagent prompt templates.
Ingestion points: Repository files, .agents/agent-models.md, and user-provided queries are ingested by SKILL.md and passed to templates in references/explainer-prompt.md and references/explorer-prompt.md using {} placeholders.
Boundary markers: The skill does not use specific delimiters to separate untrusted data within the templates, but it includes strong system-level instructions in SKILL.md and the templates themselves requiring subagents to remain local and avoid external communication.
Capability inventory: The skill is capable of file system reading, repository searching, and subagent orchestration. Subagents are provided with read-only permissions where supported by the host.
Sanitization: No explicit sanitization or escaping of interpolated strings is performed; however, the skill's strictly scoped capabilities and internal safety pings ("no agent may communicate with a person", "keep findings local") provide effective mitigation against typical exfiltration targets of indirect injection.
[EXTERNAL_DOWNLOADS]: The THIRD_PARTY_NOTICES.md file references an external repository at github.com/cursor/plugins for license attribution and source identification. This reference is for documentation purposes and does not indicate any dynamic downloads or remote code execution by the skill at runtime.

how