The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the infsh CLI tool to perform web searches and data extraction. This is documented and restricted via the allowed-tools manifest, which limits the agent to only executing the infsh command, preventing arbitrary shell command execution.
[EXTERNAL_DOWNLOADS]: The skill references an external installation guide for the infsh CLI hosted on the vendor's official GitHub repository. These references are part of the legitimate setup process and do not trigger unauthorized or hidden background downloads.
[PROMPT_INJECTION]: As the skill retrieves and processes content from external websites via Tavily and Exa, it inherently possesses an indirect prompt injection surface. Malicious text on a searched webpage could attempt to influence the agent's behavior. This is a standard risk for all search-capable skills rather than a specific malicious implementation in this code.
[DATA_EXFILTRATION]: No sensitive file access or unauthorized data exfiltration patterns were detected. Network communication is limited to the search and extraction services provided by the vendor as described in the skill's purpose.

web-search