The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a gemini command where the topic and context inputs are directly interpolated into the command string (gemini -y -p "<filled Research Prompt Template>"). A malicious user could provide a topic like $(id) or ; rm -rf / to execute arbitrary shell commands on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted data. 1. Ingestion points: The {topic} and {context} variables in SKILL.md. 2. Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present. 3. Capability inventory: The skill has access to web search/fetch tools, bash command execution, and filesystem write operations. 4. Sanitization: No input validation or escaping is performed on the user-supplied data.
[DATA_EXFILTRATION]: The combination of network access (via Claude's WebSearch and WebFetch) and filesystem write capabilities (mkdir -p docs/research and file saving) creates a high risk of data exfiltration if the agent is manipulated via command or prompt injection.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch and process content from arbitrary URLs on the internet, which exposes the system to malicious payloads or instructions designed to exploit the agent's capabilities.

research