The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function is to fetch and process arbitrary web content to extract claims and definitions.
Ingestion points: External articles and documentation fetched via the WebFetch tool or pasted text input.
Boundary markers: The skill documentation (in reference/article-workflow.md, agents/searcher.md, and agents/challenger.md) explicitly defines an 'untrusted content boundary,' instructing agents to treat fetched data strictly as facts and to ignore any embedded directives or prompt-like patterns.
Capability inventory: The orchestrator and agents have the ability to write files to the knowledge base, execute bash commands (used for local maintenance), and perform network operations via WebSearch and WebFetch tools.
Sanitization: reference/fetch-content.md implements strict URL validation, restricting schemes to http/https and blocking access to private IP ranges and localhost.
[EXTERNAL_DOWNLOADS]: The skill downloads external data as part of its learning workflow.
Evidence: reference/fetch-content.md details procedures for using reader, trafilatura, and WebFetch to download article content for analysis.
Evidence: The skill recommends the installation of reader-cli and trafilatura to improve content extraction quality.
[COMMAND_EXECUTION]: The skill uses local shell commands for repository management and integrity validation.
Evidence: scripts/validate_kb.py uses subprocess.run to execute git diff and git ls-files to track changes in the knowledge base files. These commands are hardcoded and do not accept untrusted user input.

kb-learn