The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes metadata (names and descriptions) from other SKILL.md files found on the local filesystem. This data is interpolated into the agent's context to generate recommendations, which could allow a malicious local skill to influence the router's behavior or mislead the user.
Ingestion points: The scripts/list_skills.py script reads the frontmatter of any SKILL.md file located in ~/.agents/skills, project-specific .agents/skills directories, or paths specified in the AGENT_SKILLS_ROOT environment variable.
Boundary markers: The response format in SKILL.md uses basic delimiters for candidate listing but lacks explicit instructions for the agent to ignore or sanitize instructions potentially embedded within those external descriptions.
Capability inventory: The skill facilitates the discovery and sequencing of other agent skills and requires the execution of a local Python script (scripts/list_skills.py).
Sanitization: The discovery script performs basic whitespace and quote stripping on metadata values but does not validate or sanitize the content for prompt injection patterns before passing it to the agent.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script (scripts/list_skills.py) to retrieve the list of available skills.
Evidence: The SKILL.md file explicitly mentions running scripts/list_skills.py --json to identify skill names and descriptions from the filesystem.

skill-router