The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes metadata from external SKILL.md files during its discovery process, which represents an indirect prompt injection surface. However, this risk is mitigated by several design factors:
Ingestion points: Metadata is read from SKILL.md files discovered by scripts/scan_registry.py within a restricted directory depth of 3.
Boundary markers: The scripts/orchestrate.py tool explicitly injects advisory instructions into generated plans, warning the agent to treat paths and metadata as untrusted and to validate all actions before execution.
Capability inventory: The skill's scripts are strictly limited to filesystem scanning, metadata parsing, and plan generation; they do not include networking capabilities or functions for arbitrary command execution.
Sanitization: The parser uses yaml.safe_load() for YAML frontmatter and employs strict regex-based word-boundary matching for keyword extraction, preventing the execution of embedded instructions during the scanning phase.
[SAFE]: The implementation demonstrates strong security practices through multiple defensive layers. It explicitly verifies that the user-defined data directory and all scanned entrypoint files are not symbolic links, effectively blocking symlink-based path traversal attacks. The scan process is strictly bounded by directory depth and entrypoint quantity limits to prevent resource exhaustion, and all data persistence is handled through atomic, safe-write operations in a private, authorized directory.

agent-orchestrator