The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/logos.md contains a reference to the domain marathondh.com within a lookup table for company logos. Automated security scans have identified this domain as malicious. Although the skill uses the domain as a parameter for a well-known favicon service rather than as a direct download source, the inclusion of blacklisted domains in the skill's reference data represents a potential risk.
[PROMPT_INJECTION]: The skill implements a workflow to aggregate data from multiple upstream analysis modules and render them into a single HTML document.
Ingestion points: Untrusted data enters the agent context through inputs from modules such as business-narrative, company-valuation, and earnings-recap, as described in SKILL.md.
Boundary markers: The skill correctly uses quoted bash heredocs (<<'HTML') to provide a shell execution boundary, but it lacks specific HTML delimiters or instructions to the agent to treat interpolated content as untrusted data.
Capability inventory: The skill has the capability to write files to the local file system using bash and to serve these files to the user via the present_files tool.
Sanitization: There is no evidence of HTML escaping, validation, or filtering of the external content before it is interpolated into the HTML report scaffold. This creates a surface for indirect prompt injection where malicious content in the upstream data could execute scripts in the context of the rendered report.

bf-report