The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The searxng up command fetches the SearXNG source code from its upstream repository and performs a local build and installation process.
[EXTERNAL_DOWNLOADS]: The skill utilizes uvx to download and run the websearch-skill package from the public package registry.
[COMMAND_EXECUTION]: The skill's functionality is delivered through a CLI tool. While it uses arguments for queries and URLs, there is an inherent risk of command injection if the agent fails to properly quote user-supplied input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web. It implements a security mechanism using nonce-validated fencing to help the agent distinguish between data and instructions.
Ingestion points: web-search and web-fetch commands (SKILL.md).
Boundary markers: Nonce-based fences (<<UNTRUSTED-WEB-CONTENT nonce="...">>) are present.
Capability inventory: Network access, shell execution (websearch CLI), and file writes (.env).
Sanitization: Content is wrapped in fenced blocks; datamark option available to mark word boundaries.

web-search