The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of external software components from unverified sources, including npx skills add belt-sh/cli and various skills from the inference-sh repository. These sources are not recognized as trusted vendors and lack version pinning, posing a supply chain risk.
[DYNAMIC_EXECUTION]: The instructions provide templates for generating and executing arbitrary Python code at runtime via the infsh/python-executor tool. This pattern, used for tasks like generating benchmark charts, allows for the execution of dynamically constructed logic, which can be exploited if the prompt context is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external search results (belt app run exa/search) without adequate sanitization or boundary markers.
Ingestion points: External content from the exa/search tool is incorporated into the agent's context in SKILL.md to inform technical research.
Boundary markers: There are no explicit delimiters or instructions to treat external data as untrusted or to ignore instructions embedded within the search results.
Capability inventory: The agent possesses significant capabilities, including filesystem/shell access via Bash(belt *) and arbitrary Python execution.
Sanitization: The skill lacks logic to filter or sanitize the retrieved technical content before it influences subsequent tool execution or content generation.
[COMMAND_EXECUTION]: The skill leverages the Bash(belt *) tool to perform network-reliant operations and execute remote applications, expanding the attack surface for command injection if user-supplied input or external data flows into these command templates.

technical-blog-writing