The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external web sources to generate research dossiers, creating an attack surface for indirect prompt injection.
Ingestion points: Data enters the agent's context in Step 3 (Sweep) through web search results, page fetching via tools like Firecrawl, and social-pulse tools monitoring community threads.
Boundary markers: While the instructions require claims to be carried as quotes with citations, there are no technical delimiters or explicit instructions for the agent to ignore potential instructions embedded within the scraped external content.
Capability inventory: The agent possesses capabilities to write to local markdown files (wiki/research/, index.md, hub/research.md, log.md) and execute a local script (scripts/graph-audit).
Sanitization: The process lacks documented sanitization, escaping, or filtering of external content before it is interpolated into the synthesis and written to durable files.
[COMMAND_EXECUTION]: The skill invokes a local script as a mandatory part of its filing workflow.
Evidence: Step 5 (Mandatory filing gate) requires the execution of scripts/graph-audit on every dossier and touched file to validate document integrity.
[DATA_EXFILTRATION]: The skill accesses configuration files outside its immediate directory using relative path traversal.
Evidence: Step 0 (Preflight) references reading ${CLAUDE_SKILL_DIR}/../../CONVENTIONS.md, which resolves to a file two directory levels above the skill's installed location to access shared plugin contracts.

research