The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon untrusted data from external web pages, creating a potential attack surface.
Ingestion points: The agent reads page content using reticle_look and performs assertions on text and state using reticle_assert (found in SKILL.md).
Boundary markers: The instructions do not define specific boundary markers or 'ignore' commands for the content being read.
Capability inventory: The skill uses tools with significant capabilities including reticle_network_mock (intercepting and modifying traffic), reticle_act_and_wait (executing clicks), and reticle_navigate (reloading or moving to new URLs).
Sanitization: There is no evidence of sanitization or filtering of the external page content before the agent processes it.
[COMMAND_EXECUTION]: The documentation suggests the execution of a setup command that downloads and runs code.
Evidence: RETICLE_INSTALL_SOURCE=npx_skill npx @reticlehq/server@latest init mentioned in SKILL.md. This command uses npx to fetch and execute the vendor's server package.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation and references external scripts from the vendor's infrastructure.
Evidence: The skill references curl https://docs.reticle.sh/capabilities.md and curl https://docs.reticle.sh/llms.txt, as well as skills hosted on github.com/reticlehq/reticle.

verify-optimistic-update