The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands for workspace initialization in references/01-meta-initialization.md, specifically mkdir -p "<workdir>/waypoints". Since the workdir is a user-controllable input, this presents a risk of command injection if the underlying execution environment does not properly sanitize the variable before it is interpolated into the shell command.
[COMMAND_EXECUTION]: In references/00-research-standards.md, the instructions direct the agent to use curl to download PDF files from URLs discovered during web research. Although the skill includes specific security warnings (e.g., using single quotes and avoiding shell metacharacters), the use of manual shell commands with untrusted external URLs is a known security risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting and summarizing untrusted data from the web.
Ingestion points: External data enters the context via WebSearch, WebFetch, pubmed MCP, clinical-trials MCP, and curl downloads (as described in references/00-research-standards.md and the research phase files).
Boundary markers: The skill does not explicitly require the use of strict delimiters or boundary instructions to isolate external content, although it encourages summarization to manage context.
Capability inventory: The agent possesses capabilities to execute shell commands (mkdir, curl), perform file system writes (Write), and spawn parallel sub-agents (Agent).
Sanitization: The skill provides security-conscious instructions for the agent to manually validate URLs for shell metacharacters before execution.

indication-dossier