The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge to external web content, which presents a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through the highlight and full_content fields in the search results described in SKILL.md.
Boundary markers: The documentation does not specify explicit delimiters or "ignore instructions" wrappers for the retrieved content.
Capability inventory: The skill primarily uses curl for network retrieval. No secondary capabilities like file-system writes or arbitrary command execution are triggered by the search results within this skill's scope.
Sanitization: There is no evidence of content sanitization or validation for the text returned from the web results.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides instructions for the user to store an OCTEN_API_KEY in standard configuration files (e.g., ~/.claude/settings.json, ~/.bashrc). This is a documented setup procedure for secret management and does not constitute unauthorized access or exfiltration.

octen-search