The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's Python SDK (scripts/discoverability-sdk.py) uses subprocess.run to interact with local Node.js utility scripts (e.g., install-subsystem-hooks.js, run-ledger.js) located in the agent's environment. These calls use absolute paths for the scripts and a list-based argument structure without a shell, preventing shell injection and ensuring execution is restricted to known local tools.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. 1. Ingestion points: Reads discoverability.config.yaml and SEO evidence files (evidence/discoverability/*.json). 2. Boundary markers: Present; the SDK normalizes untrusted file data into structured formats before agent handoff. 3. Capability inventory: The skill uses Bash, Write, and Agent tools. 4. Sanitization: Present; the SDK uses structural parsers (YAML/JSON) and filters incoming metrics to ensure data integrity.
[EXTERNAL_DOWNLOADS]: The skill's documentation references authoritative industry sources such as Arxiv, Wikipedia, and Search Engine Land for Generative Engine Optimization (GEO) and SEO standards. These references are to well-known technical services and do not represent a security risk.

discoverability-orchestrator