The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external metadata such as page titles and source content which are subsequently interpolated into the agent's response, presenting a potential surface for indirect prompt injection if source metadata contains malicious instructions.
Ingestion points: scripts/sources.py ingests URLs, titles, and page text through the add, ingest, and quote subcommands.
Boundary markers: The rendered Sources: block provides structural separation, though it does not use explicit delimiters to encapsulate potentially untrusted metadata like titles.
Capability inventory: The sources.py script is restricted to local file system read/write operations for ledger management and evidence verification; it contains no network or arbitrary code execution capabilities.
Sanitization: The script implements URL normalization and markdown/whitespace cleanup for evidence matching, but does not perform specialized sanitization on source titles.
[SAFE]: The Python scripts (scripts/sources.py and scripts/_hermes_home.py) rely exclusively on the standard library, avoiding risks associated with external package dependencies.
[SAFE]: File operations are handled securely using atomic writes via temporary files and a robust cross-process locking mechanism (_LedgerLock) for the JSON ledger.
[SAFE]: The skill instructions promote security best practices by encouraging the use of verbatim quotes for evidence and manual verification of generated drafts.

grounded-citations