The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Because it fetches and processes the first 2000 characters of external web pages, a malicious site could include instructions designed to hijack the agent's behavior (e.g., forcing a 'VERIFIED' status for false information).
Ingestion points: The content returned from web_fetch(url) in Step 1 and the url field in the input JSON.
Boundary markers: Absent. The fetched content is processed directly without delimiters or warnings to the agent to ignore embedded instructions within that content.
Capability inventory: web_fetch (network read access).
Sanitization: Absent. The agent is instructed to record the content snippet and search for quotes literally without filtering.
[EXTERNAL_DOWNLOADS]: The skill performs dynamic network requests based on input URLs.
In Step 1, it executes web_fetch(url) for every citation object provided in the input JSON. While this is the intended purpose of the citation auditor, it allows the agent to interact with arbitrary external endpoints specified in the input data.

reference-validator