The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves the 'ingest' procedure, where the agent fetches, processes, and preserves content from untrusted external URLs (web pages, PDFs, etc.). This ingested data is then cited and linked throughout the knowledge base. This creates a surface for indirect prompt injection, as malicious instructions embedded within the source content could potentially influence the agent's future reasoning or tool usage when it processes these docs.
Ingestion points: Defined in references/ingest-and-sources.md, where external URLs are fetched via WebFetch or curl.
Boundary markers: The skill uses markdown wrappers with YAML frontmatter to isolate metadata, but does not specify delimiters to neutralize instructions within the extracted text body.
Capability inventory: The agent has access to exec (shell commands like cat/ls/grep), write, and edit tools to modify the project environment.
Sanitization: The skill provides significant sanitization guidelines for file paths (slug derivation) and blocks executable file extensions.
[EXTERNAL_DOWNLOADS]: The skill provides detailed instructions for downloading external resources using curl. It implements several security 'STOP gates' to mitigate risks, including protocol restrictions (http/https only), redirect limits, and file size caps (100MB hard limit) to prevent SSRF and resource exhaustion.
[COMMAND_EXECUTION]: The skill utilizes an exec tool for file system operations (ls, cat, grep, find). While the tool description specifies a restricted implementation ('not a shell'), the agent is instructed to use these commands to explore the workspace and verify ingestion results. It also involves shell-based utility calls for sha256sum and mkdir.

open-knowledge