The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves fetching external content from URLs using the scrapling tool and saving it to raw/sources/. This content is subsequently read and synthesized by the LLM to update wiki pages. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in captured web pages (e.g., in hidden HTML comments or text) could attempt to influence the agent's summarization or synthesis behavior.
Ingestion points: scripts/ingest-url.sh downloads external content and saves it to a local markdown file.
Boundary markers: The skill does not implement specific boundary markers or instructions for the LLM to ignore instructions found within the ingested raw source files.
Capability inventory: The skill utilizes Bash for workflow automation, WebFetch (via the scrapling CLI) for network access, and Read/Write/Edit tools for maintaining the vault structure.
Sanitization: The raw content is saved as captured from the source URL without sanitization before being processed by the LLM.
[COMMAND_EXECUTION]: The skill relies on several shell scripts (bootstrap-vault.sh, ingest-url.sh, new-query-note.sh) and a Python script (lint-wiki.py) to manage the vault environment. These scripts perform file system operations, execute external tools, and use inline Python code to modify files. While these are legitimate for the skill's purpose, they represent a significant level of command execution authority within the project directory.
[EXTERNAL_DOWNLOADS]: The ingest-url.sh script is designed to download content from arbitrary user-provided URLs. This is an intended feature but inherently involves interacting with external, untrusted network resources.

llm-wiki