The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection vulnerability surface due to the ingestion and processing of untrusted data from the web.
Ingestion points: Untrusted third-party business names, reviews, addresses, and social profile text are ingested via nimble search and nimble extract tools across Steps 5, 6, 7, and 8 in SKILL.md.
Boundary markers: Absent. There are no explicit instructions or structural delimiters specified to ensure the agent ignores any embedded instructions or malicious content contained within the retrieved business descriptions or reviews.
Capability inventory: The skill possesses extensive capabilities including file modification (Write, Edit), Python shell execution (Bash(python3:*)), and local document viewing (Bash(open:*)).
Sanitization: Absent. No escaping, filtering, or validation is mentioned to sanitize the ingested data before formatting it into final outputs or dynamic map templates.
[DYNAMIC_EXECUTION]: In Step 11 of SKILL.md and the map generation section of references/wsa-pipeline.md, the skill dynamically constructs a local HTML file (~/.nimble/memory/local-places/{slug}-map-{date}.html) embedded with Leaflet.js and OpenStreetMap configurations. It populates this template with unvalidated external data (business names, reviews, and URLs) and executes it locally using the shell open command, presenting a potential local Cross-Site Scripting (XSS) or script injection risk if the third-party business records contain malicious payloads.

local-places