The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates descriptions from all skills listed in the catalog to build its routing table, creating a vector for cross-skill instruction injection.
Ingestion points: The scripts/render_routes.py script reads the catalog.json file and then opens every SKILL.md file referenced in the catalog to extract the description field from its YAML frontmatter.
Boundary markers: The extracted descriptions are placed directly into a Markdown table in SKILL.md. There are no specific delimiters or instructions to the agent to disregard any embedded commands within those descriptions.
Capability inventory: The skill itself contains instructions to invoke other specialized skills based on the user's request. The maintenance script scripts/render_routes.py has the capability to overwrite the skill's own SKILL.md file when the --write flag is used.
Sanitization: The Python script performs basic character escaping for the pipe symbol (|) to ensure the Markdown table structure remains intact, but it does not filter or sanitize the content for potential prompt injection or natural language instructions.
[COMMAND_EXECUTION]: The skill includes a maintenance script scripts/render_routes.py that is intended to be executed in the development environment to sync the routing table.
Evidence: The script uses argparse to handle command-line arguments like --write and --check, and it uses pathlib to perform file system operations (reading catalog and skill files, and writing to SKILL.md). This is standard repository maintenance behavior and not inherently malicious, but it represents the execution surface associated with the skill.

ask-rhdh