The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. The skill_discovery.py script ingests content from external SKILL.md files discovered on the filesystem. This content is interpolated into LLM prompts in both skill_discovery.py and workflow_composer.py to determine relevance and data-flow dependencies. While the scripts utilize structured JSON protocols to manage data, they lack explicit boundary markers or specific sanitization to prevent adversarial instructions within third-party metadata from potentially biasing the matching or composition logic.
[EXTERNAL_DOWNLOADS]: The _llm_client.py module facilitates network communication with well-known technology services including OpenAI, Anthropic, DeepSeek, and Alibaba Cloud (DashScope) for LLM processing. These interactions are conducted over standard HTTPS and are necessary for the skill's matching and analysis functionality.

skill-composition