The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the kagi CLI tool to perform search and retrieval tasks. The allowed-tools frontmatter restricts execution to kagi:* commands in Bash, following the principle of least privilege for command access.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and summarize untrusted data from the open web and personal email.
Ingestion points: External content is pulled into the agent's context through kagi extract, kagi search --follow, kagi summarize, and kagi mail read.
Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or triple backticks) to wrap external content, nor do they provide a system-level instruction to ignore commands embedded in the retrieved text.
Capability inventory: The agent possesses the capability to execute shell commands via Bash and potentially other skill-routed tasks like reasoning and research (kagi-ai).
Sanitization: There is no mention of sanitizing, filtering, or escaping the retrieved content before it is processed by the agent.

kagi-usage