The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from untrusted external sources (YouTube transcripts, PDFs, and GitHub repositories) and uses this content to modify a persistent knowledge base.
Ingestion points: Phase 1 fetches content from arbitrary external sources including YouTube URLs, audio files, PDFs, and GitHub repositories.
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate ingested text from the agent's instructions, increasing the risk that embedded commands in the media could be executed by the LLM.
Capability inventory: The agent has significant write permissions, including the ability to create/modify pages (put_page), add links (add_link), and update timeline entries across several core directories (concepts/, people/, companies/, sources/).
Sanitization: While the skill includes quality control instructions, it lacks explicit sanitization or filtering logic to detect or neutralize adversarial instructions embedded within the ingested media content.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch transcripts from arbitrary video URLs and clones external GitHub repositories for architectural summarization. This interaction with unverified external infrastructure is central to the skill's purpose but represents a persistent entry point for untrusted data.
[COMMAND_EXECUTION]: The skill utilizes a custom tool suite (gbrain) for file operations, synchronization, and timeline management. These actions involve executing shell-level commands using parameters (such as slugs and titles) derived from external media metadata, which could be exploited if not properly sanitized.

media-ingest