The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing untrusted task descriptions and context data.
Ingestion points: The execute_dynamic_dispatch and analyze_task_requirements methods in SKILL.md accept task and context objects as input.
Boundary markers: The provided code snippets do not show any use of delimiters or instructions to the agent to ignore embedded commands within the ingested data.
Capability inventory: The skill possesses significant capabilities, including the ability to execute other skills, MCP servers, and external AI agents via the ExecutionOrchestrator class in SKILL.md.
Sanitization: There is no evidence of input validation, escaping, or filtering of the task data before it is used to influence routing decisions or passed to execution targets.
[DYNAMIC_EXECUTION]: The skill is designed to perform runtime selection and execution of components. The ExecutionOrchestrator logic in SKILL.md uses computed identifiers (e.g., optimal_target.target_id) to invoke execute_skill, execute_mcp, and execute_agent. This dynamic invocation pattern determines the agent's behavior at runtime based on potentially untrusted task characteristics.
[COMMAND_EXECUTION]: The usage examples in SKILL.md demonstrate invoking a Python script (tools/dynamic_skill_dispatcher.py) with various command-line arguments derived from user input, such as --task and --code-path. The script itself is not provided in the skill files, which prevents verification of how these arguments are handled and whether they are vulnerable to command injection.

dynamic-skill-dispatcher