The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y to download and execute a third-party Node.js package at runtime.
Evidence: npx -y @willh/felo-cli --json "<query>" found in SKILL.md and references/workflow.md.
The -y flag bypasses the interactive confirmation prompt, executing the remote package automatically.
[COMMAND_EXECUTION]: User-provided search queries are interpolated directly into shell commands.
Evidence: npx -y @willh/felo-cli --json "<query>" in SKILL.md.
If the <query> input is not properly sanitized, it could lead to command injection where an attacker supplies shell metacharacters.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via search results.
Ingestion points: Untrusted web content is ingested through the data.answer and data.resources fields of the Felo API response, as described in references/api-contract.md.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings for the agent when processing search data.
Capability inventory: The agent has access to shell execution (npx) and network operations (https://openapi.felo.ai).
Sanitization: No sanitization or validation of the remote content is specified before it is returned to the agent context.

felo-cli