The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from external sources via linkup search results and aviato company data. There are no explicit boundary markers or instructions to isolate the agent's logic from instructions that might be embedded in the retrieved web content. The agent has the capability to execute subsequent tool calls using orth run based on the processed data, and no sanitization of the retrieved content is specified.
[PROMPT_INJECTION]: Improper Parameter Interpolation. The skill constructs JSON request bodies using direct string interpolation of user-provided variables like {company_name} in the orth run tool calls. Without proper escaping, specially crafted user inputs containing double quotes or other JSON control characters could lead to malformed requests or parameter injection in the API calls.

account-research-brief