The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web, which creates a surface for indirect prompt injection attacks.
Ingestion points: functions/source_store.py retrieves external content via the fetch and refetch commands.
Boundary markers: The skill uses a custom fence <nav-untrusted-source> defined in functions/untrusted.py with a mandatory preamble instructing the agent to treat the content strictly as data.
Capability inventory: The skill utilizes Read, Write, Edit, Bash, WebSearch, WebFetch, and Task tools. Network access is handled via the urllib library.
Sanitization: functions/source_store.py implements an _TextExtractor (based on html.parser.HTMLParser) that strips dangerous tags including <script>, <style>, <noscript>, and <iframe> before the content is processed by the agent.
[COMMAND_EXECUTION]: The skill uses shell commands and Python sub-processes for internal pipeline orchestration.
Evidence: SKILL.md contains Bash blocks that execute the skill's own Python scripts (e.g., research_run.py) to manage state transitions.
Testing Infrastructure: Automated scanners correctly identified subprocess.run calls in the test suite (functions/test_*.py). These are standard unit tests that execute the skill's CLI tools for validation and do not represent a security risk.
[EXTERNAL_DOWNLOADS]: The skill downloads external data from the web as its primary function.
Evidence: functions/source_store.py uses urllib.request to fetch research sources. The fetched content is parsed and neutralized before being stored in the research directory. The automated heuristic for remote code execution in test_source_store.py is a false positive, as the downloaded data is not executed or piped to a shell.

nav-deep-research