The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to scrape and process content from external websites, creating a surface for indirect prompt injection where malicious instructions on a website could influence subagent behavior.
Ingestion points: Web content is retrieved through a persistent Chromium browser, curl, and Python HTTP libraries (requests, curl_cffi) as described in listener/README.md.
Boundary markers: The skill uses an 'Escalation ladder' and mandatory journal entries (subagents/subagent-prompt.md) to force subagents to provide verifiable evidence for their claims.
Capability inventory: Subagents can execute shell commands within their respective Docker containers via the agentbox exec command (bin/agentbox) and perform network operations.
Sanitization: The orchestrator is instructed to perform a 'Claim Audit' (logs/logs.md) by cross-referencing subagent claims with the detailed request and command logs captured by the listeners.
[DYNAMIC_EXECUTION]: The skill uses Python monkey-patching and hook mechanisms to ensure all network activity is logged.
Monkey Patching: image/tools/agentbox_hook.py patches the builtins.__import__ function and wraps the Session.send and Session.request methods of the requests and curl_cffi libraries.
Automation: The hook is automatically loaded into every Python process in the container via a .pth file (image/Dockerfile).
Materialization: The installation process (docker/02-workspace.md) requires the agent to dynamically create the toolset on the host filesystem by copying code blocks from the skill documentation.
[COMMAND_EXECUTION]: The skill provides a host-side CLI (bin/agentbox) that executes arbitrary shell commands inside Docker containers using docker exec. While these commands are run within a sandboxed environment, they allow subagents to execute code and interact with the containerized filesystem.

agentbox