The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill indexes content from all skill.yaml files within a directory tree. This creates a surface where a malicious skill definition could influence the behavior of the agent consuming the generated map.
Ingestion points: Reads description and capabilities fields from every skill.yaml file found in the base_directory tree.
Boundary markers: Absent. There are no delimiters or instructions provided to the agent to treat the discovered metadata as untrusted data rather than authoritative instructions.
Capability inventory: The skill performs directory traversal and file reading; it does not contain execution capabilities like subprocess spawning or network access.
Sanitization: The skill performs YAML structure validation but lacks semantic sanitization of the string content being indexed.

agent-capability-discovery