The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to perform its workflow:
Runs python3 scripts/fetch-sources.py to scrape external content.
Uses cat -n to read both user corpus files and saved expert essays, exposing file contents and line numbers to the agent.
Performs filesystem operations including cp assets/essays-AGENTS.md <repo>/essays/AGENTS.md and ln -s to create a symlink for CLAUDE.md.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch external content:
Invokes DeepAPI via POST /v1/search/web to find relevant essays based on search queries.
Scrapes full text from user-provided and search-discovered URLs using DeepAPI's scraping capabilities.
Mentions using curl for ad-hoc network calls to handle proxy issues.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the web:
Ingestion points: Scraped content from external URLs is saved to local .md files in the essays/ directory.
Boundary markers: The workflow lacks explicit delimiters or instructions to the agent to ignore any embedded commands or malicious instructions within the scraped content or the user's corpus.
Capability inventory: The agent has the ability to execute shell commands (cat, python3, cp, ln) and read files based on the content it processes.
Sanitization: The skill performs basic stripping of "site layout junk" but does not perform rigorous sanitization or validation of the prose text before the agent reads it.
[CREDENTIALS_UNSAFE]: The instructions direct the agent to load API keys by running source ~/.deepapi/env, which involves reading credentials from a sensitive file path in the user's home directory.

signal-from-expert