The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a utility script scripts/generate_market_visuals.py that uses the Python subprocess module to programmatically execute other local scripts (generate_schematic.py and generate_image.py). This is a legitimate functional requirement for batching visualization tasks. The script uses structured argument lists (not shell=True), which follows security best practices to prevent command injection.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves and processes external data from the internet via the research-lookup tool. This is an inherent risk for research-focused agents.
Ingestion points: Data returned by the research-lookup tool and stored in the sources/ directory.
Boundary markers: The instructions do not define specific delimiters or warnings to treat research data as untrusted content when generating the report.
Capability inventory: The agent is permitted to use Bash, Write, Edit, and Read tools across its lifecycle.
Sanitization: There is no evidence of automated filtering or sanitization of the research data before it is interpolated into the report drafting prompts.

market-research-reports