The Agent Skills Directory

Indirect Prompt Injection Awareness: The skill includes a clear security note regarding retrieved content. It advises treating all document results as untrusted data, as they may contain adversarial instructions designed to hijack the agent's behavior. This is a standard consideration for RAG (Retrieval-Augmented Generation) patterns.
Secure Credential Handling: Authentication relies on GLEAN_API_TOKEN, which the documentation states is injected by the execution environment. The shell scripts use these environment variables without hardcoding secrets, which is consistent with secure development practices.
Network and System Operations: The skill utilizes curl for API interactions and jq for data processing. These operations are scoped to the defined GLEAN_BASE_URL and do not exhibit signs of data exfiltration to unauthorized third-party domains.
Shell Script Safety: The bundled scripts (es_search.sh, es_read.sh) use set -euo pipefail for robust error handling and avoid dangerous dynamic code execution patterns like eval or piping remote URLs directly into a shell.

enterprise-search