The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a high surface area for Indirect Prompt Injection (Category 8). It is designed to ingest and process untrusted content from various external sources, including public web pages, community forums (Reddit, Hacker News), and document files (PDF, DOCX, XLSX, etc.) via the markitdown-document-ingestion companion skill.
Ingestion Points: Mentions fetching content from 'Hermes web search', 'Jina Reader', 'yt-dlp metadata', and external documents.
Boundary Markers: The instructions lack technical delimiters (e.g., XML tags or specific boundary markers) to isolate external content from the agent's instructions, though they do provide structural guidelines for the agent to separate facts from interpretation.
Capability Inventory: The skill has access to shell execution (python3, gh, yt-dlp) and file conversion tools, which could be abused if an injected instruction successfully manipulates the agent.
Sanitization: No explicit sanitization or filtering of external content is described beyond the use of Markdown conversion.
[COMMAND_EXECUTION]: The skill provides instructions for the agent (or user) to execute several CLI tools and scripts.
Evidence: Mentions using yt-dlp for metadata, gh for GitHub API checks, and specifically instructs running python3 tools/source_reach_doctor.py from the repository root to verify the environment.
Concern: The script tools/source_reach_doctor.py is not provided within the skill package for review, constituting the execution of unverified local code.

research-intelligence