The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a 'CRITICAL: Output Behavior' section that attempts to override the agent's operational logic, instructing it to 'ALWAYS' prioritize specific file writes and bypass standard planning modes.
[COMMAND_EXECUTION]: The skill identifies and executes a binary file named 'browse' from dynamically determined paths, including ~/.claude/skills/lazyweb-skill/browse/dist/browse. It also encourages the execution of a ./setup script located in the user's home directory folder structure.
[DATA_EXFILTRATION]: The skill reads from ~/.lazyweb/libraries.json, a configuration file that likely contains sensitive session information or credentials for connected third-party services.
[EXTERNAL_DOWNLOADS]: The skill uses curl to download files from remote imageUrl locations provided by external tools and saves them to the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection by processing untrusted data from web searches and tool outputs.
Ingestion points: Content from WebSearch and lazyweb_search MCP tool outputs (e.g., visionDescription).
Boundary markers: None identified.
Capability inventory: Bash (used for curl, cat, and binary execution), Write (for report and image generation).
Sanitization: No sanitization or validation of external descriptions or URLs was found before they are used in shell commands and reports.

lazyweb-design-research