The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including external research reports (references/process.md) and web search results (references/run.md).
Ingestion points: External reports are copied to imports/ and read by subagents; web search results are fanned out to researcher assistants.
Boundary markers: The skill implements a "research firewall" rule, where subagents receive only their specific brief and no ambient project context (memory, code, or persistent facts) unless explicitly granted.
Capability inventory: The skill uses uv run to execute local Python scripts (scripts/recon_kit.py) and utilizes subagents with tool access (web search).
Sanitization: External content is processed by recon_kit.py, which includes a dedicated command (escape-sources) to validate URLs (http/s only) and escape HTML content before rendering the final briefing.
[PROMPT_INJECTION]: The skill utilizes configuration-driven extension hooks (activation_steps_prepend, activation_steps_append, and on_complete in customize.toml) which execute instructions stored in variables. While these are intended features for customization, they represent a surface where instructions are dynamically injected into the agent's flow based on configuration files.
[SAFE]: The skill follows security best practices by using deterministic local scripts for high-stakes tasks like citation tallying and HTML escaping, rather than relying on LLM intuition. The explicit "research firewall" and citation validation logic demonstrate a high level of security awareness.

bmad-deep-recon