The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions specify the execution of a Python script where variables generated by the LLM are interpolated directly into a shell command.
Evidence: The file SKILL.md instructs the agent to execute: python scripts/web_search.py "<nextSearchTopic>" where nextSearchTopic is determined dynamically by the model.
Risk: If the LLM produces a string containing shell control characters (e.g., ;, &&, |), it could lead to arbitrary command execution if the agent platform executes the string literally in a shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill follows an iterative loop that ingests external, untrusted content from the web and feeds it back into the LLM context to guide further actions.
Ingestion points: Search results (findings) are collected from the byted-web-search tool and stored in the findings array as described in SKILL.md.
Boundary markers: The workflow does not define specific delimiters or "ignore" instructions to prevent the LLM from being manipulated by malicious directives embedded in search results.
Capability inventory: The skill possesses the capability to execute shell scripts and generate final reports based on the aggregated untrusted data.
Sanitization: No mention is made of filtering or sanitizing the retrieved search results before they are processed by the LLM to decide the next iteration's search topic.

byted-deepsearch