The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script brief.py utilizes importlib.util to dynamically locate, load, and execute a Python module from the relative path ../pipeline/deals.py. This runtime loading of code from outside the skill's immediate directory is a security risk as it depends on the integrity of the surrounding environment.
[INDIRECT_PROMPT_INJECTION]: The skill fetches HTML content from external, user-specified or contact-provided websites and interpolates extracted text (such as titles, headings, and descriptions) directly into a Markdown brief for the AI agent to process. This lacks sufficient sanitization or boundary markers to prevent instructions embedded on those websites from influencing the agent's behavior.
Ingestion points: brief.py fetches content from arbitrary URLs via urllib.request.
Boundary markers: No specific delimiters or "ignore instructions" warnings are present in the generated brief template.
Capability inventory: The skill can read closer/pipeline.json, write to the closer/research/ directory, and perform outbound network GET requests.
Sanitization: Content is processed via regex and htmllib.unescape, which does not filter for prompt injection attacks.
[DATA_EXFILTRATION]: The skill accesses local project data in closer/pipeline.json and has the capability to perform network requests. This combination of sensitive local data access and arbitrary network connectivity represents a data exposure risk.

researcher