The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks. It interpolates untrusted data from multiple sources (user prompts and external research results) directly into LLM context windows without using boundary markers, XML tags, or protective instructions. Specifically:
In src/planning_agent.py, the user's prompt is inserted directly into the system instructions for the planner agent.
In src/agents.py, the context (which contains potentially attacker-controlled text from web searches) is concatenated and passed to the writer agent.
Ingestion points: /generate_report endpoint (SKILL.md), tavily_search_tool, arxiv_search_tool, and wikipedia_search_tool (src/research_tools.py).
Boundary markers: Absent. No delimiters are used to separate instructions from data.
Capability inventory: The skill can perform network requests and write to a Postgres database based on agent decisions.
Sanitization: Absent. Data is used verbatim from tool outputs.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fetch research data from well-known services. These include:
POST requests to the Tavily Search API (https://api.tavily.com/search).
GET requests to the arXiv API (http://export.arxiv.org/api/query).
Interactions with Wikipedia via the wikipedia Python library.

deeplearning-ai-agentic-research