The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent searches a 'cloud community' registry and is then explicitly instructed to "read SKILL.md at local_path, follow the instructions" for any matching results. This creates a vulnerability to indirect prompt injection, as an attacker could publish a malicious skill to the community registry containing instructions designed to hijack the agent's behavior.
Ingestion points: Content is ingested from the search_skills tool output, specifically the SKILL.md files downloaded from the cloud community.
Boundary markers: There are no instructions or delimiters provided to ensure the agent treats the content of the discovered skills as untrusted data.
Capability inventory: The agent is told to "follow the instructions," which effectively grants the external content access to all tools and capabilities available to the agent.
Sanitization: No validation or sanitization of the downloaded skill instructions is mentioned or performed.
[EXTERNAL_DOWNLOADS]: The search_skills tool includes an auto_import parameter (enabled by default) that automatically downloads external content from the 'cloud community' to the local environment.

skill-discovery