The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates a local HTML portal by interpolating user-provided inputs and external search results into a static template without proper HTML escaping, creating a potential cross-site scripting (XSS) surface within the generated file.
Ingestion points: Data enters the agent context via the --company and --industry command-line arguments in scripts/gen_smart_intel.py, as well as results from patsnap_search and web_search tools.
Boundary markers: Absent; the data is directly concatenated into the HTML string buffer.
Capability inventory: The skill includes the capability to write files to the local file system (Path.write_text in gen_smart_intel.py).
Sanitization: Absent; the Python script uses raw string concatenation to build the interactive UI, which does not filter or escape potentially malicious characters (e.g., <script> tags) that might be present in enterprise names or news headlines.

smart-intel