The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill dynamically discovers and reads metadata (such as descriptions and tags) from other local SKILL.md files to generate its categorized directory listings. This represents an attack surface where a malicious local skill could attempt to influence the agent's behavior via displayed content.
Ingestion points: The skill uses the Grep and Read tools to search for and extract frontmatter from files within the plugin root or source directory.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potentially adversarial content found in the metadata of discovered skills.
Capability inventory: The skill's potential for harm is significantly mitigated by its restricted toolset; it is limited to AskUserQuestion, Read, Grep, and Glob, and lacks the ability to execute shell commands or perform network operations.
Sanitization: Metadata fields are ingested and displayed without validation against a strict schema or sanitization of their content.

help