The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process content from untrusted external URLs (source_url) to perform verification tasks. This creates a surface for indirect prompt injection, where an attacker could place instructions in a source document to manipulate the verification outcome.
Ingestion points: references/workspace-conventions.md specifies that source content is fetched and stored in cogni-claims/sources/ for analysis.
Boundary markers: The SKILL.md requires the use of hedged language (e.g., "appears to overstate") to frame findings as assessments rather than definitive facts, reducing the risk of the agent or user blindly following injected instructions.
Capability inventory: The skill uses Write and Edit tools to maintain its registry and optionally update local entity files (e.g., markets/*.json) via the EntityRef system. This write capability is gated by mandatory user confirmation for all resolutions.
Sanitization: There is no explicit description of sanitization or filtering applied to the fetched content before LLM processing.
[COMMAND_EXECUTION]: The skill documentation includes shell command examples for workspace initialization (mkdir -p) and URL hashing (shasum -a 256). These are routine filesystem and data processing operations required for the skill's stated purpose of managing local claim records within the project workspace.

claim-entity