The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the web and uses it to synthesize new instructions and executable scripts.
Ingestion points: The skill uses search_web, read_url_content, and a browser_subagent (defined in SKILL.md step 3) to fetch data from arbitrary third-party URLs.
Boundary markers: There are no explicit delimiters or instructions provided to the agent or sub-agent to ignore potential command-like patterns within the scraped documentation.
Capability inventory: The skill possesses the write_to_file capability, which it uses to create new skill directories, SKILL.md files, and potentially executable scripts in a scripts/ folder.
Sanitization: No sanitization or validation logic is present to filter out malicious instructions or code snippets that might be embedded in the scraped source material.

self-learning