The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large amounts of untrusted data from third-party web sources (LinkedIn, Glassdoor, MCA filings, news). This creates an inherent attack surface for indirect prompt injection where malicious instructions could be embedded in search results.
Ingestion points: Web search tools, web page content, social media bios, and news articles processed across 20 research steps.
Boundary markers: The skill explicitly implements 'Content trust boundary' directives in references/research-principles.md and 'Injection guards' in synthesis steps like wave3/step15-bd-intelligence-briefing/SKILL.md.
Capability inventory: The skill uses file system access for state persistence in the .state/ directory and executes local TypeScript scripts via bun run. It uses subagent dispatching (Task or spawn_agent) for parallel processing.
Sanitization: The skill employs a defense-in-depth strategy: (1) Worker-layer self-sanitization, (2) Deterministic regex-based Sanitizer Gates (Gate #1 and Gate #2) described in references/sanitizer.md, and (3) LLM-based Checker criteria in references/checker-criteria.md specifically checking for semantic injection variants.
[PROMPT_INJECTION]: Static analysis flagged references/checker-criteria.md and references/research-principles.md for instruction override patterns. Upon manual review, these are defensive security rules (e.g., 'ignore previous instructions' listed in a regex blacklist) intended to detect and redact attacks, rather than malicious injections themselves.
[DATA_EXFILTRATION]: While the skill collects sensitive business data, it does so within the context of its stated BD research purpose. There are no hardcoded credentials or unauthorized network operations. Input hardening is applied to extracted director names in wave1/step6-directors/SKILL.md to prevent path-traversal or command injection attempts.
[DYNAMIC_EXECUTION]: The skill uses bun run to execute internal scripts (format-report.ts, validate-output.ts, score-icp.ts). These scripts are part of the skill package and do not execute dynamically generated or remote code. references/research-principles.md explicitly forbids executing code or loading files referenced by fetched web content.

company-research