The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted data from web searches (Tavily, WebSearch) and user-provided assumptions during Phase 3. However, this is mitigated by significant architectural safeguards.
Ingestion points: Web search results and external documentation during the 'Evidence Gathering' phase (SKILL.md, Phase 3).
Boundary markers: The skill requires explicit user confirmation of the operationalized assumption (GATE 1) and a mandatory curation pass via an advisor or adversarial self-check (GATE 3) before any verdict is reached.
Capability inventory: Access to project context, git history, web search tools, file writing (reports), and the ability to run 'Technical Spikes' (code execution).
Sanitization: Precise operationalization in Phase 1 transforms fuzzy user inputs into measurable, testable claims, reducing the risk of malicious instruction propagation.
[DYNAMIC_EXECUTION]: The 'Technical Spike' research method involves writing and executing small programs to observe library behavior (references/research-methods.csv). While this involves dynamic code execution, it is an intended feature for technical validation and is gated by user approval of the research methodology in Phase 2.
[DATA_EXPOSURE]: The skill performs a silent scan of the project stack (Phase 0) and accesses the git history (git log) to determine if an assumption has already been addressed. This is standard context gathering for developer-focused agents and does not involve exfiltration of sensitive information.

structured-research