The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The taxonomy describes a keyword-based categorization system that processes metadata from other skills (untrusted data). An attacker could craft a malicious skill description to manipulate the manager's classification and bypass protection levels.
Ingestion points: references/skills_taxonomy.md (via the categorize_skill pseudo-code logic).
Boundary markers: Absent; no delimiters or warnings for embedded instructions are specified in the classification framework.
Capability inventory: config/skills-manager-config.yml enables significant capabilities including file deletion, merging, archiving, and automated Git commits.
Sanitization: No sanitization or validation of metadata keywords is mentioned in the algorithm description.
[Dynamic Execution] (LOW): The test_skill_loading setting in config/skills-manager-config.yml implies the system validates skills by attempting to load or import them. This presents a risk of executing untrusted code if a malicious skill is present in the managed directory.

skills-manager