The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to fetch and process untrusted information from the open web, which creates a significant indirect prompt injection surface.
Ingestion points: Data enters the context via web_search snippets and scrape_webpage content across all skill files.
Boundary markers: The instructions do not define or require the use of boundary markers or isolation techniques for external data.
Capability inventory: The skill possesses file-system access (writing to search/ directories) and shell access (executing gh, grep, and bash).
Sanitization: No sanitization or validation protocols are described for the ingested content before it is used by the model or in shell commands.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use shell environments for specific tasks.
Evidence: SKILL.md and reference/recipes.md recommend using the gh CLI via bash for GitHub interactions. reference/scaling.md suggests using grep or bash to process files in the pages/ directory that contain untrusted scraped markdown.
[EXTERNAL_DOWNLOADS]: The skill's primary function involves downloading content from arbitrary external URLs.
Evidence: The web_search and scrape_webpage tools are the core components of the skill, enabling the retrieval of data from any accessible web resource.

search