The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of untrusted data from the public internet, creating a significant attack surface.
Ingestion points: The source_store.py script fetches content from external URLs using WebSearch and WebFetch tools.
Boundary markers: The implementation includes a dedicated security fence system in untrusted.py, wrapping all fetched content in <nav-untrusted-source> tags with a clear preamble instructing the agent to treat the content as data only.
Capability inventory: The skill environment includes Bash for workflow orchestration, WebSearch and WebFetch for data retrieval, and Task for spawning subagents.
Sanitization: Fetched HTML is parsed for plain text in source_store.py, and untrusted.py includes deterministic logic to neutralize forged fence tags encountered within the external data to prevent boundary escapes.
[COMMAND_EXECUTION]: Several test files, including test_research_run.py, test_ship_gate.py, and test_source_store.py, utilize the subprocess module. These calls are standard development practices used to execute the skill's own CLI tools within a controlled unit testing environment.
[EXTERNAL_DOWNLOADS]: The skill uses the standard Python urllib library in source_store.py to retrieve research materials from the web. These operations are core to the skill's research function, and the fetched content is handled safely via the fencing system.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged potential remote code execution due to the combination of network downloads and subprocess calls in the same files. A manual audit confirms these are false positives; the downloads in source_store.py populate data notes that are never executed, and the subprocess calls in the test suite only run the skill's own implementation for validation purposes.

nav-deep-research