The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources which can influence the agent's logic or the content of the final report.
Ingestion points: In Phase 3, researchers fetch content from arbitrary web pages and local codebase files.
Boundary markers: The instructions do not specify the use of delimiters or XML tags when passing researched content to the synthesizer or delivery agents, increasing the risk that the agent may follow instructions embedded in research data.
Capability inventory: The skill can spawn parallel subagents, access the web, read local files, and write new files to the system.
Sanitization: There are no requirements for the researchers or the synthesizer to sanitize, escape, or filter external content before it is processed or written to disk.
[DATA_EXFILTRATION]: The skill provides the ability to read the local codebase and interact with the web, creating a potential path for sensitive data exposure.
Evidence: Phase 3 researchers are explicitly instructed to use the codebase as a source. If a researcher is compromised via indirect prompt injection from a web source, it could be directed to leak codebase contents via web search queries or fetch requests.
[COMMAND_EXECUTION]: Phase 5 involves automated file system operations based on synthesized data.
Evidence: The skill spawns 'writer subagents' to simultaneously write several markdown files to a directory path provided by the user. While this is a requested feature, the automated writing of synthesized (potentially untrusted) content to the local disk represents a significant file system interaction capability.

deep-research