The Agent Skills Directory

[PROMPT_INJECTION]: The skill involves ingesting and reading external research materials and local repository files (e.g., through the ref/inbox/ directory and files like AGENTS.md). This creates a surface for indirect prompt injection where untrusted data could contain malicious instructions. However, the skill treats these files as passive evidence rather than executable content.
Ingestion points: Untrusted data enters via ref/inbox/ and is processed from the ref/ and plans/notes/notebook/ directories.
Boundary markers: No explicit delimiters are used to separate untrusted content from the agent's system instructions.
Capability inventory: The skill utilizes standard file system utilities like rg --files and find for exploration, and performs basic file read/write operations.
Sanitization: No explicit sanitization of external content is mentioned.
[DATA_EXFILTRATION]: No hardcoded credentials, sensitive file access (like SSH or AWS keys), or unauthorized network operations were found. The skill emphasizes local repository management.
[REMOTE_CODE_EXECUTION]: There are no instructions for downloading or executing remote code or scripts.
[COMMAND_EXECUTION]: The commands mentioned (rg, find) are used for legitimate repository structure exploration and do not involve shell injection or privilege escalation.
[SAFE]: The skill explicitly recommends security best practices, such as requiring HTML publications to be self-contained without external CDN dependencies or remote scripts.

auto-research-repo