The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches financial data and documents from Daloopa's official domains and uses the WebSearch tool to identify supply chain partners. These operations are essential to the skill's primary function as a financial analysis tool.- [COMMAND_EXECUTION]: The skill uses the open tool to allow the user to view the generated HTML dashboard upon completion of the research.- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted information from web searches and external documents.- Ingestion points: External data is ingested via WebSearch results and search_documents calls across multiple research phases.- Boundary markers: No explicit delimiters are provided in the instructions to separate untrusted web content from the agent's internal processing logic.- Capability inventory: The skill can write to the local file system (reports/ directory) and execute the open command to launch browser-based content.- Sanitization: The instructions include a mandatory DOM safety rule that forbids the use of innerHTML or outerHTML, requiring the agent to use safe alternatives like createElement and textContent. This design choice prevents the execution of malicious code that might be embedded in the retrieved web data.

supply-chain