The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting large amounts of untrusted data from external social media platforms (Reddit, X, TikTok, Instagram, YouTube) and web search results, which creates a significant surface for indirect prompt injection attacks.
Ingestion points: Untrusted content enters the agent's context through tools like serper, exa, firecrawl, and scrapecreators as detailed in SKILL.md and references/source-map.md.
Boundary markers: The instructions lack explicit boundary markers or delimiters to signal to the model that the ingested web content should be treated as untrusted data.
Capability inventory: The skill possesses the capability to execute shell commands via the deepline CLI and local Python scripts, write files (reports and evaluation results), and perform network operations via curl to the vendor's API.
Sanitization: While the skill documentation mentions "noise stripping" and "normalization," there is no evidence of robust sanitization designed to prevent malicious instructions embedded in web content from hijacking the agent's behavior.
[COMMAND_EXECUTION]: The skill relies on the execution of several local Python scripts and a CLI tool to perform its primary functions.
Evidence: SKILL.md contains instructions for running scripts/query_design.py and scripts/evaluate_examples.py. It also frequently invokes the deepline CLI tool for authentication, tool discovery, and execution.
[EXTERNAL_DOWNLOADS]: The skill setup process involves external downloads and remote repository checks, primarily targeting the vendor's infrastructure.
Evidence: SKILL.md instructs the user to install the deepline package via npm using the vendor's registry (https://code.deepline.com/api/v2/npm/) and performs a git ls-remote check against the mvanhorn/last30days-skill repository to verify versions.

deepline-pre-research