The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses a script (scripts/ingest_source.py) that dynamically modifies the Python module search path (sys.path) at runtime. It attempts to locate a dependency called library-rag by checking a LIBRARY_RAG_SCRIPTS environment variable and various relative or home-directory paths (e.g., ~/.hermes/skills/research/library-rag/scripts). Dynamically resolving and importing executable code from computed paths poses a security risk if the execution environment or filesystem is not strictly controlled.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted external sources to build a research vault, creating a potential vector for indirect prompt injection.
Ingestion points: The skill uses web_search, web_extract, and browser tools to fetch content from the internet, and also accepts user-provided files which are saved to the sources/ directory.
Boundary markers: While the skill uses specific formatting tags like [vault] and [background], it lacks robust instructions to ensure the agent ignores instructions embedded within the extracted source text.
Capability inventory: The agent has permissions to write files to the workspace, browse the web, and execute local scripts via the terminal tool.
Sanitization: The skill includes a rule to strip credentials from ingested content, but it does not implement sanitization or filtering to detect malicious prompts within the sources.
[COMMAND_EXECUTION]: The skill makes frequent use of the terminal tool to run its internal Python scripts (ingest_source.py and parse_reference.py) for indexing and reference resolution. Relying on shell execution for core functionality increases the agent's overall permission footprint and potential attack surface.

notebooklm-mode