The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch RSS data from an external URL and then perform a "full-scale deep reading" of every article link found within that feed. This creates an attack surface where instructions hidden inside the external RSS feed or the linked articles (such as HTML comments or specifically crafted text) could be interpreted as commands by the agent, potentially leading to unintended actions.
Ingestion points: The RSS feed XML/JSON at youmind.com and all original article links extracted from that feed (SKILL.md).
Boundary markers: None present. The instructions do not include delimiters or specific warnings to ignore commands embedded in the fetched content.
Capability inventory: The agent uses the WebFetch tool for network requests and has the ability to create and write to new document files.
Sanitization: None present. The workflow explicitly mandates reading all content without filtering or validation.
[METADATA_POISONING]: The skill includes a file named .security-scan-passed which claims a security scan was performed and passed on a specific date. This metadata is deceptive as it attempts to falsely establish the skill's safety status and could lead a user or automated system to misjudge the risks associated with the skill's execution.

karpathy-rss-daily-briefing