The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It processes untrusted data from web searches (Stage 1) and local files (Stage 4) which are then interpreted by sub-agents and rolled up into a final report.
Ingestion points: Web search results in Stage 1 and local file content in Stage 4.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the briefings passed to sub-agents.
Capability inventory: The skill can write files to the local filesystem and spawn multiple parallel sub-agents.
Sanitization: No evidence of sanitization or filtering of the external content before it is processed by the LLM.
[DATA_EXFILTRATION]: The skill explicitly grants sub-agents the capability to "read local files if the topic calls for it" in Stage 4. This creates a risk of exposing sensitive local data if a research query (or a malicious injection) directs the agent toward sensitive directories or configuration files.
[DATA_EXFILTRATION]: In Stage 6, the skill writes a report to a path constructed using a user-controlled variable: research/<topic-slug>-YYYY-MM-DD.md. There is no evidence of sanitization for the topic-slug, which could potentially allow path traversal if a user provides a malicious research goal (e.g., using ../../ in the topic name).
[COMMAND_EXECUTION]: The skill automates the launch of multiple background sub-agents at "max parallelism" (Stage 4). While this is a native feature of the platform, the dynamic orchestration of multiple processes based on instructions derived from user input and web data increases the complexity and potential impact of any successful prompt injection.

research-fanout