The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes robust instructions that strictly forbid the agent from writing, running, or scaffolding code. It explicitly names and prohibits risky actions such as npm install, creating benchmark harnesses, or building prototypes, which prevents arbitrary command execution.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: No remote code execution patterns or package dependencies are present. The skill's logic is purely informational and restricts the agent to reading and citing primary documentation.
[DATA_EXPOSURE_AND_EXFILTRATION]: Network activity is restricted to public web searches and fetching documentation via WebSearch and WebFetch. The skill does not access sensitive system paths (e.g., .ssh, .env, or AWS credentials) and only writes research artifacts to a designated documentation directory (docs/research/).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external primary sources.
Ingestion points: WebSearch and WebFetch output (SKILL.md).
Boundary markers: None explicitly defined in the prompt instructions, though the skill mandates citing specific dates and versions.
Capability inventory: Write (file system), WebFetch (network access).
Sanitization: Not explicitly mentioned for external content.
Note: This is a standard surface for research tools; the risk is mitigated by the skill's strict policy against code execution and focus on citing load-bearing claims.

researchkit