The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents and implements a comprehensive 'Untrusted-Data Contract' in SKILL.md Phase 3.5 to mitigate risks from web search snippets. • Ingestion points: External content from platforms like Reddit, Hacker News, and X via WebSearch. • Boundary markers: Uses an 'orchestrator-level fence' and discrete output files (DISCOURSE.md). • Capability inventory: Executes Python scripts and performs file writes to the project root. • Sanitization: Automatically scans captured snippets for over 20 instruction-shaped patterns (e.g., 'ignore previous', 'exfiltrate'), prefixes matches with '[SUSPICIOUS-SNIPPET]', and enforces schema validation in the Python layer.
[DYNAMIC_EXECUTION]: The wrapper script scripts/discourse_research.py uses importlib.util to dynamically load and execute the core implementation from a path computed at runtime. This behavior is mitigated by strict validation: it requires an absolute path, forbids directory traversal ('..'), and ensures the target file is not the wrapper itself.
[COMMAND_EXECUTION]: The skill uses python3 calls for secure temporary file creation using tempfile.mkstemp (with 0600 permissions) and for running its internal research logic. All environment variable usage for script directories is validated for absolute paths to prevent hijacking.

blog-discourse