The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted user input and propagate it across a multi-step execution chain, creating a surface for indirect prompt injection.
Ingestion points: The $ARGUMENTS block in SKILL.md captures the mission description, which is then structured into a 'Mission Brief'.
Boundary markers: The skill uses a structured Markdown template for the brief, but it lacks explicit 'ignore embedded instructions' warnings when passing this context to subagents.
Capability inventory: The orchestrator has the ability to write files (.mission-state.json, iterations.md), scan directories, and delegate tasks to subagents which may have full system/tool access.
Sanitization: There is no evidence of filtering or sanitization of the input description before it is interpolated into the prompts for every subagent in the pipeline.
[DYNAMIC_EXECUTION]: The skill performs dynamic discovery and invocation of external executable content (skills and commands) based on the filesystem state.
Evidence: Phase 4 ('Command discovery') and Phase 5 ('Step dispatch') describe an algorithm that scans project and home directories for SKILL.md files or command scripts. It then instructs subagents to 'invoke it (via the skill tool or by reading its SKILL.md inline)'. This effectively executes instructions found in the environment that were not part of the original skill package.
[DATA_EXPOSURE]: The skill attempts to access information outside of the immediate project workspace.
Evidence: The discovery algorithm in references/agent-integrations.md explicitly includes searching for 'home-level' directories (e.g., ~/.hermes/skills). While this is used to identify available tools, probing for the existence of directories in the user's home folder is a form of metadata exposure.

mission-brief