The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external sources, creating a surface for indirect prompt injection attacks.
Ingestion points: In Phase 1 (SKILL.md), the agent fetches live landing page content via the /browse tool and reads files from the user's codebase.
Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or unique markers) to separate user data from instructions, nor do they include warnings to ignore embedded commands in the analyzed content.
Capability inventory: The skill utilizes file system read/write access and network browsing capabilities.
Sanitization: There is no evidence of sanitization, filtering, or escaping logic applied to the content retrieved from external URLs or the local codebase before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The Dependency Preflight section in SKILL.md directs the user to install external dependencies from third-party sources.
Evidence: It recommends installing the browse skill from github:garrytan/gstack:browse and the agent-skill-manager via npm.
Context: While these are common tools in the agent ecosystem, the repository is a third-party source outside of the defined trusted organizations list.
[COMMAND_EXECUTION]: The skill includes a mandatory preflight check that involves executing shell commands to verify the environment.
Evidence: The skill instructs the agent to run asm list -p claude --json | grep -q '"browse"' and test -d "$HOME/.claude/skills/browse" to check for required components.

viral-product-evaluator