The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting and summarizing content from untrusted external sources like web pages, Reddit, X, and Hacker News.\n
Ingestion points: Untrusted data enters the agent context through 'SKILL.md', 'references/web-research-collection.md', 'references/social-signal-pass.md', and 'references/exa-advanced-search-categories.md'.\n
Boundary markers: The instructions do not specify the use of delimiters (like XML tags or markdown blocks) to wrap external content, nor do they include specific 'ignore instructions' warnings for the agent when processing retrieved data.\n
Capability inventory: The skill employs tools for network operations (Exa, Firecrawl), file system access (writing to '.firecrawl/'), and subprocess execution (Firecrawl CLI).\n
Sanitization: There is no evidence of content sanitization, escaping, or validation performed on external content before it is processed or synthesized into recommendations.\n- [DATA_EXFILTRATION]: The skill framework describes a workflow where the agent reads sensitive internal materials (such as 'CRM history', 'internal documents', 'tickets', and 'call notes') and subsequently performs network operations using external search and scraping tools. This creates an architectural surface for data exposure if internal context is inadvertently included in external tool prompts or web requests.\n- [COMMAND_EXECUTION]: 'references/web-research-collection.md' provides detailed examples of shell commands for the Firecrawl CLI tool (e.g., 'firecrawl search', 'firecrawl scrape', 'firecrawl interact'). These involve spawning subprocesses to perform web research tasks and browser-based interactions, which are powerful capabilities that could be misused if influenced by malicious external input.

research