The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing data from untrusted external sources (competitor websites).
Ingestion points: Untrusted content enters the agent's context through the execution of firecrawl.py map and firecrawl.py scrape in the SKILL.md file.
Boundary markers: The instructions do not explicitly mandate the use of delimiters or specific system instructions to ignore potential commands embedded within the scraped website content.
Capability inventory: The skill is authorized to write to the file system at memory/research/ and modify persistent memory files such as memory/hot-cache.md and memory/open-loops.md.
Sanitization: No explicit sanitization or filtering of the scraped text content is mentioned beyond a pre-flight check of robots.txt for access permissions.

content-gap-analysis