The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest untrusted data from external sources and provides the agent with high-privilege capabilities such as command execution and file modification, creating a surface for indirect attacks.
- Ingestion points: Untrusted data enters the agent context through the browser when researching comparable products, reading online manuals, or viewing game footage on third-party sites (specified in SKILL.md sections 2 and 7).
- Boundary markers: The instructions mention using polite-browser-use and explicitly forbid submitting data or entering private areas, which serves as a basic delimiter for safety but does not sanitize the content the agent reads.
- Capability inventory: The agent is authorized to run formatters, linters, tests, build commands, game exports, and firmware compilers, all of which involve subprocess/shell execution (specified in SKILL.md section 7).
- Sanitization: There is no mention of sanitizing or validating external content before it is used to 'Synthesize decisions' or influence the 'UI/system contract', allowing malicious instructions in research materials to potentially influence local execution.

research-backed-frontend-development