The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on web search results to gather market data and competitor intelligence. Untrusted content from third-party websites (such as malicious reviews or SEO-optimized attack pages) could influence the quantitative analysis or inject instructions into the generated HTML reports.
Ingestion points: Web search results from sources like Crunchbase, LinkedIn, G2, and Capterra (referenced in references/competitive_analysis.md and references/pmf_indicators.md).
Boundary markers: None specified; instructions do not include clear delimiters for separating external data from internal logic.
Capability inventory: File-write capability via HTML report generation.
Sanitization: No explicit sanitization or filtering of external data is mentioned before it is interpolated into the report templates.
[COMMAND_EXECUTION]: The skill allows for custom file paths and naming for the generated reports. If not properly constrained by the platform, this could lead to path traversal or unintended overwriting of sensitive files.
Evidence: SKILL.md and references/report_template.md specify that users can provide custom folders and filenames for report output.
[EXTERNAL_DOWNLOADS]: The generated HTML reports fetch resources from external services for styling and typography.
Evidence: The report template in references/report_template.md loads Tailwind CSS from cdn.jsdelivr.net and the Pretendard font from cdn.jsdelivr.net and github.com/orioncactus.

biz-opportunity-scout