The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest, scrape, and synthesize content from 15-25 external URLs, creating a significant attack surface for indirect prompt injection. Findings from these untrusted sources are integrated into a final research report without explicit sanitization or boundary markers.
Ingestion points: Web content via Firecrawl (scrape, crawl), Google Search (search_web), and GitHub repository content (get_file_contents).
Boundary markers: Absent. The instructions do not specify delimiters or warnings for the agent to ignore instructions embedded in the scraped content.
Capability inventory: The agent has capabilities for network access, local file writing (research_report.md, .agent/state/last-run.json), and image generation.
Sanitization: No explicit sanitization or filtering logic is provided for the content extracted from external URLs.
[DYNAMIC_EXECUTION]: The skill provides specific shell and Python code snippets in its reference documentation (references/research-heuristics.md) for the agent to use when processing binary files like DOCX.
Evidence: The file contains a shell pipeline (unzip -p ... | sed ...) and a Python script using zipfile and ElementTree for extraction. While these are standard utility patterns, they encourage the agent to construct and execute code at runtime to handle potentially untrusted local files.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill interacts with the Agentic OS shared-memory model by reading and updating .agent/state/last-run.json. While this is a standard platform integration for state management, it involves accessing internal agent metadata. No credentials or non-whitelisted exfiltration domains were detected.

deep-research