The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands (e.g., claude -p ...) to dispatch tasks to sub-agents. These commands use file reading and interpolation ($(cat workspace/prompts/task-${task}.md)), which is a pattern that can lead to unintended execution if the environment or variables are manipulated.
[EXTERNAL_DOWNLOADS]: The workflow relies heavily on web_search and web_fetch to gather data from untrusted external sources, which is a prerequisite for indirect injection attacks.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes data from external websites without sufficient sanitization or boundary markers.
Ingestion points: Data enters the agent's context through web_search and web_fetch tools defined in reference/subagent-prompt.md and SKILL.md.
Boundary markers: No explicit delimiters or 'ignore embedded instructions' warnings are used when processing the fetched content.
Capability inventory: The agent has access to web_search, web_fetch, write, shell execution via the claude CLI, and imageGen tools.
Sanitization: There are no mechanisms identified for escaping or validating the content retrieved from the web before it is used to influence the Lead Agent's planning and generation phases.

notion-infographic