The Agent Skills Directory

[PROMPT_INJECTION]: The skill's primary function involves ingesting and processing large volumes of untrusted data from external sources (web pages, GitHub repositories, PDFs, media), creating a potential surface for indirect prompt injection.
Ingestion points: SKILL.md (Workflow Step 4), references/fetch-content.md (Standard pages, repositories, PDFs), references/media.md (Video/audio analysis), and references/web-search.md (Query strategy).
Boundary markers: While the skill instructs the agent to separate facts from inference and use .progress/ files, it does not mandate technical delimiters (e.g., XML tags or specific markers) to isolate untrusted external content from the core instructions.
Capability inventory: The skill leverages capabilities for web search, content retrieval, local repository cloning/access, local file reading (manifests/lockfiles), and media processing.
Sanitization: There are no specific instructions for technical sanitization or escaping of retrieved content, though the workflow emphasizes verification against primary sources to mitigate misinformation.
[REMOTE_CODE_EXECUTION]: The skill provides guidance on handling external code repositories, but explicitly mitigates execution risk.
Evidence: references/fetch-content.md contains the rule: "Treat repository scripts and downloaded artifacts as untrusted; reading does not require executing them."
[CREDENTIALS_UNSAFE]: The skill contains proactive measures to prevent data exposure.
Evidence: SKILL.md includes the rule: "Never store secrets, credentials, private session data, or sensitive source content in research notes."

web-research