The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to run local Python scripts (scan_registry.py, match_skills.py, and orchestrate.py) to manage the discovery and ranking of agents. These scripts use safe execution patterns (executing via list arguments rather than shell strings) and do not attempt to escalate privileges or access sensitive system paths.
[PROMPT_INJECTION]: The orchestrator's core discovery mechanism is vulnerable to indirect prompt injection. It automatically scans the workspace and subdirectories for any SKILL.md file and extracts its name, description, and capabilities to build a registry. A malicious skill file placed in the search path could use deceptive metadata to trick the orchestrator into matching it for specific queries, ultimately leading the agent to follow instructions defined in the malicious file. 1. Ingestion points: scripts/scan_registry.py searches and reads all SKILL.md files in the repository. 2. Boundary markers: The orchestration results do not include delimiters or warnings to the agent to disregard instructions embedded in the discovered skills' metadata. 3. Capability inventory: The orchestrator generates execution plans that explicitly direct the agent to 'Read [SKILL.md] and follow its workflow'. 4. Sanitization: There is no validation or sanitization of the content extracted from external skill files before it is presented to the agent as an authoritative instruction.

agent-orchestrator