The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted web data.
Ingestion points: Untrusted content is scraped from the web via Firecrawl and GitHub and stored in the raw/ directory, as described in SKILL.md Procedure 2.
Boundary markers: The instructions (Procedure 3 and Procedure 5) do not specify the use of delimiters or boundary markers to separate untrusted content from system instructions when loading data into context.
Capability inventory: The agent has the ability to read and write files, as well as execute local scripts and CLI tools like firecrawl and qmd.
Sanitization: No filtering or sanitization steps are defined to prevent embedded instructions in raw sources from being interpreted as commands by the LLM during the compilation or query phases.
[COMMAND_EXECUTION]: The skill utilizes local shell and Python scripts for administrative tasks.
The scripts/new-topic.sh script automates folder creation and template substitution using standard system utilities like mkdir and sed.
The scripts/lint-wiki.py script performs static analysis of markdown files to detect broken links and orphaned articles using standard Python libraries.
Both scripts operate within the expected scope of the skill and do not perform unauthorized network access or sensitive file operations.

karpathy-kb