The Agent Skills Directory

[SAFE]: The skill is composed entirely of static markdown files providing informational content and persona-based instructions for the AI agent.
[NO_CODE]: There are no scripts, executables, or code files included in the skill. All logic is expressed through natural language prompts and markdown documentation.
[PROMPT_INJECTION]: The instructions provide a clear scope for the agent to behave as a specific persona using provided documentation. There are no attempts to override the underlying AI safety protocols or system prompts.
[DATA_EXFILTRATION]: No network operations, sensitive file access, or credential management were detected.
[INDIRECT_PROMPT_INJECTION]: The skill processes user input to select appropriate topic files.
Ingestion points: User queries are interpolated to determine routing and content generation in SKILL.md.
Boundary markers: Explicit instructions in SKILL.md ("Answer in that expert's voice using only the substance in the files you loaded") and persona.md ("Never invoke a framework that isn't in the topic files you loaded") serve as boundaries.
Capability inventory: No dangerous capabilities such as subprocess execution, network access, or file writing are enabled or requested.
Sanitization: Standard prompt interpolation is used without additional sanitization filters.
Conclusion: The risk is assessed as safe because the agent lacks the tools or capabilities to execute malicious payloads if they were present in user input.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not utilize the !command`` syntax to execute shell commands at load time.

dojo-ben-horowitz