The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a workflow that is vulnerable to indirect prompt injection. It fetches arbitrary web content via the search and extract commands and saves it to the local sources/ directory. The documentation explicitly instructs the agent to read these files for context before making new queries, which allows malicious instructions embedded in a retrieved web page to potentially hijack the agent's behavior.\n
Ingestion points: Web content retrieved from arbitrary URLs via scripts/parallel_web.py.\n
Boundary markers: Results are saved as markdown with basic headers, but there are no strict delimiters or 'ignore instructions' warnings wrapping the retrieved content to prevent agent obedience.\n
Capability inventory: The skill has file-writing capabilities through the -o flag in scripts/parallel_web.py, and the agent is granted Bash access, increasing the risk of successful injection.\n
Sanitization: No sanitization or filtering is applied to the retrieved web content before it is stored in the project workspace.\n- [EXTERNAL_DOWNLOADS]: The skill relies on the openai and parallel-web Python packages. These are legitimate dependencies required for the skill's documented functionality and represent standard usage of established and vendor-specific libraries.

parallel-web