The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources (URLs) provided by the user. This content is then used to generate new markdown files, creating a surface for indirect prompt injection attacks where malicious instructions in a web page could influence the agent's behavior.
Ingestion points: The webfetch and web search tools are used in Phase 1 of the workflow (defined in SKILL.md and references/url-fetch-strategy.md) to retrieve content from arbitrary user-provided URLs.
Boundary markers: There are no explicit instructions or delimiters defined to tell the agent to ignore or isolate instructions found within the fetched content. The skill relies on the agent to follow a specific markdown template but does not explicitly guard against content-level overrides.
Capability inventory: The skill has the capability to fetch remote data (webfetch), list files (Glob/ls), and write files to the local file system (using the user-provided path).
Sanitization: While filename sanitization is implemented (stripping illegal characters), there is no sanitization or filtering of the retrieved content to remove potential injection strings before they are processed by the model.
[COMMAND_EXECUTION]: The references/resource-md-template.md file instructs the agent to obtain the current timestamp by executing shell commands (date) or Python scripts. While these are routine operations for generating metadata, they involve the execution of system-level commands to generate the created and modified fields in the markdown frontmatter.

link-summarizer