The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the public web (Reddit, X, Hacker News, etc.) but implements a multi-layered defense-in-depth strategy.
Ingestion points: Data enters the system via WebSearch snippets in Phase 3.
Boundary markers: The skill mandates a scan for instruction-shaped patterns (e.g., 'ignore previous', 'exfiltrate') and applies a [SUSPICIOUS-SNIPPET] prefix to flag problematic content for reviewers. It also relies on a downstream orchestrator fence mentioned in the project context.
Capability inventory: The skill executes a local Python script scripts/discourse_research.py and performs file writes for the output brief and temporary files.
Sanitization: The Python helper script enforces strict schema validation, limits string lengths to 4000 characters, rejects control characters, and performs markdown escaping (escaping backslashes, backticks, and brackets) to prevent the generated brief from interfering with downstream agent logic.
[DATA_EXPOSURE]: The skill manages temporary files securely. In Phase 3, it uses tempfile.mkstemp via a Python one-liner to create files with mode 0600 (owner-only access) and unpredictable names, avoiding the risks associated with predictable /tmp/ paths.
[COMMAND_EXECUTION]: The skill avoids directory traversal and arbitrary file writes. The Python script's _resolve_output function explicitly prevents writing outside the working directory and refuses to write through symlinks, ensuring that user-provided output paths do not lead to privilege escalation or system file corruption.
[REMOTE_CODE_EXECUTION]: All processing is performed by a local Python script included in the skill package. No external scripts or packages are downloaded or executed during runtime.

blog-discourse