The Agent Skills Directory

[METADATA_POISONING]: The skill package includes a file named .security-scan-passed which contains a claim that the skill has passed external security validation (gitleaks). This is a self-referential claim of safety that attempts to establish trust through non-authoritative metadata.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (web search results) and local document content to generate reports and propose file edits, creating a vulnerability surface for indirect instructions.
Ingestion points: Reads local documents for factual claims and performs web searches for verification (e.g., search queries for AI model specs and technical docs).
Boundary markers: The workflow utilizes a structured comparison table and a formal 'Fact-Check Report' to separate findings from instructions, and explicitly requires user confirmation before making changes.
Capability inventory: Uses the Edit tool to modify local files based on gathered information.
Sanitization: The skill does not explicitly mention sanitizing or escaping content from search results to prevent the inclusion of hidden markdown instructions.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to access official documentation sites (e.g., anthropic.com, openai.com, blog.google) and package registries (npm, PyPI, crates.io) to fetch verification data.
[PROMPT_INJECTION]: The skill instructions and examples use future-dated references (e.g., 'Claude Sonnet 4.5' released in 'September 2025' and facts 'as of January 2026'). While intended as illustrative examples for the fact-checking workflow, these could potentially bias the agent's internal knowledge base if not properly scoped as hypothetical data.

fact-checker