The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install official vendor tools like the OpenKnowledge CLI (@inkeep/open-knowledge) and server packages. It also describes a procedure for fetching external source documents (URLs, PDFs, binary files) from the web to ground factual claims within the knowledge base.
[COMMAND_EXECUTION]: The agent is guided to use shell commands including curl, ls, mkdir, and sha256sum for its ingestion workflow. These commands are explicitly scoped to a secure procedure that utilizes safety flags for curl (e.g., scheme restrictions, redirect limits, and time caps) and implements a strict slugging policy to prevent path traversal.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface as it is designed to ingest and process untrusted data from external URLs and files. However, it mandates a detailed security procedure in references/ingest-and-sources.md that includes:
Ingestion points: External URLs, PDFs, and various binary/text formats entering the agent context via the ingest procedure.
Boundary markers: External content is wrapped in local markdown documents with specific metadata (e.g., preservation tags, source_url) and admonitions to distinguish it from authoritative knowledge.
Capability inventory: The skill uses MCP tools (write, edit, exec, search) and host shell capabilities (curl, ok CLI) to manage the corpus.
Sanitization: Implementation of SSRF guards in network calls, a hard blocklist for executable and scripted extensions (e.g., .exe, .sh, .svg, .xml), and a 100MB file size limit.
[DYNAMIC_EXECUTION]: The skill documents an html preview feature that renders interactive HTML, CSS, and JavaScript within a sandboxed iframe. The documentation explicitly states that the environment disables unsafe-eval and limits the iframe's access to the local knowledge base or sensitive data.

open-knowledge