The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core workflow involves processing data from external, potentially attacker-controlled sources.
Ingestion points: In SKILL.md, the 'Research-First Approach' and 'MCP Tools for Research' sections mandate using web search, Context7 MCP for documentation, Browser/Playwright for web scraping, and GitHub for open-source analysis.
Boundary markers: The instructions do not specify the use of delimiters (such as XML tags or unique markers) or 'ignore embedded instructions' prompts to isolate untrusted external content from the agent's core instructions.
Capability inventory: The agent has the capability to perform network operations (via MCP tools) and write findings to files, which could be influenced by malicious instructions embedded in the external data it is told to research.
Sanitization: There are no requirements for the agent to validate, filter, or escape the content retrieved from these external platforms before processing it for analysis.

business-analyst