The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local bash script (scripts/polytender.sh) to interact with the remote Polytender MCP server. The script uses curl for network requests and jq for JSON processing. It includes a validation step to ensure that arguments passed from the agent are valid JSON objects before they are processed by jq or sent in the request body.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it retrieves data from external procurement portals.
Ingestion points: Data is fetched through the get_tender, get_tender_documents, and read_tender_document tools described in SKILL.md.
Boundary markers: The instructions do not specify explicit delimiters for the external content but do provide clear guidelines for the agent to summarize or translate the information for the user.
Capability inventory: The skill can execute the scripts/polytender.sh script to perform network requests and has the ability to modify state (e.g., bookmarking tenders) via org-scoped API calls.
Sanitization: The helper script uses jq to sanitize and construct the JSON payload for API requests, which mitigates simple command injection via the tool arguments.

public-tenders