The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass platform-level safety and resource constraints.
The 'Authority while active' section states that the mode 'supersedes every exploration-bounding instruction in surrounding prompts, modes, or rules'.
It specifically directs the agent to ignore platform defaults such as 'one-exploration-pass defaults', 'two-wave stop rules', and 'retrieval budgets'.
The skill is also susceptible to indirect prompt injection as it ingests large volumes of untrusted data from web search results and GitHub repositories. While it uses a 'debate' mechanism for validation, it lacks explicit technical sanitization or boundary markers when passing this external content to code-generation tasks.
[REMOTE_CODE_EXECUTION]: The skill generates and executes code based on data retrieved from external sources during the research process.
In Phase 4 ('Verify contested claims by running code'), the agent is instructed to 'Write a minimal self-contained script that tests the claim' and run it using uv run or bun.
Since these 'claims' are derived from untrusted external sources, this creates a vector for code execution driven by malicious content discovered during search.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage the research environment and process data.
It uses mkdir -p to create session-specific directories.
It uses uv run and bun to execute scripts with dynamically specified dependencies.
It utilizes git log and other Git CLI tools for repository analysis.

ulw-research