The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Node.js helper script (scripts/search.js) for interacting with the Synthetic API. The testing framework in scripts/test_helper.py uses subprocess.run to call the Node.js binary on the local script for automated validation.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external web content. Evidence: (1) Ingestion points: search results are fetched from the Synthetic API in scripts/search.js and scripts/probe_synthetic_search.py; (2) Boundary markers: SKILL.md explicitly warns the agent to treat result text as data and never as instructions; (3) Capability inventory: network access (to api.synthetic.new), local file write access (via --save), and subprocess execution capabilities (in tests); (4) Sanitization: the helper script provides --compact and --chars flags to limit the amount of text returned to the agent context.
[DATA_EXPOSURE]: The skill handles SYNTHETIC_API_KEY properly through environment variables and includes code patterns to verify the key's presence without leaking its value, following secure credential management practices.

synthetic-search