The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions require the agent to execute shell commands defined in external configuration files. Specifically, the agent is directed to "Run the provider's checkCommand when configuration state matters." Executing commands sourced from data files (registries) creates a risk where a compromised or malicious configuration file could lead to arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill is designed to interact with multiple external search and scraping providers such as SearXNG, Exa, Firecrawl, and Tavily. This involves sending user data to third-party services and downloading content from arbitrary URLs on the public internet, which can expose the agent to untrusted data.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it fetches and processes external web content through its search and crawl capabilities.
Ingestion points: Untrusted data enters the agent context through the web_fetch, web_search, and web_crawl capabilities which retrieve content from external URLs.
Boundary markers: The instructions do not specify the use of delimiters or warnings to the model to ignore instructions embedded within the fetched content.
Capability inventory: The skill has access to shell execution via the checkCommand pattern and can route tasks to other roles that may have broader system permissions.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the web content before it is processed by the agent.

orchestrator