The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external websites (Y Combinator and startup homepages) and processes this content using an LLM (Perplexity) to generate evaluations and rankings.
Ingestion points: External content is fetched using the scrapegraph tool from ycombinator.com and arbitrary startup URLs in Step 1, Step 3a, and Step 3b (SKILL.md).
Boundary markers: The instructions do not define delimiters or "ignore previous instructions" warnings for the fetched content before it is interpolated into the Perplexity prompt in Step 3d.
Capability inventory: The agent has the ability to write all processed data, including potential injection payloads, to a Google Sheet using the google-sheets tool.
Sanitization: There is no evidence of sanitization or validation of the content scraped from external sources before it is used for assessment.
[DATA_EXFILTRATION]: The skill performs network operations to fetch data from a wide variety of non-whitelisted external domains during the startup website scraping phase (Step 3b).
[DATA_EXFILTRATION]: The skill uses the Apollo tool with the reveal_personal_emails: true flag to harvest founder contact information. While this aligns with the skill's stated purpose for investment research, it involves the automated collection and storage of personal PII in a spreadsheet (SKILL.md).
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (prefixed with orth run) to invoke various API tools for scraping, data lookup, and spreadsheet management.

yc-batch-evaluator