The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from task descriptions and model outputs to determine routing strategies, which creates a potential surface for instruction-based manipulation.
Ingestion points: Task classification metadata and outputs from other models/agents processed during execution.
Boundary markers: None explicitly defined in the prompt templates to isolate untrusted task data.
Capability inventory: The skill is allowed to use execute_command, write_file, create_file, and edit_file tools.
Sanitization: The skill includes specific rules (ASI07) to validate model outputs against declared schemas before further processing, though it lacks explicit sanitization for the initial task inputs used for classification.
[COMMAND_EXECUTION]: The skill's configuration allows the use of the execute_command tool. While no malicious command patterns were detected in the instructions, this tool provides a significant capability that could be targeted via prompt injection.
[SAFE]: The skill implements proactive security measures under its 'Security Guardrails' section, referencing OWASP ASI principles such as goal hijacking prevention (ASI01) and supply chain validation (ASI04). These are positive security practices.

agent-model-routing