The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it ingests and processes data from untrusted external sources.
Ingestion points: External data enters the agent context via the WebSearch tool and the output of the gemini bash command in SKILL.md (Phase 2).
Boundary markers: The instructions do not define any boundary markers (e.g., delimiters or XML tags) or specific "ignore embedded instructions" warnings for the gathered research data.
Capability inventory: The skill possesses the capability to execute shell commands (gemini) and write files to the local filesystem (report generation in ./plans/).
Sanitization: There is no evidence of sanitization, filtering, or validation of the external content before it is interpolated into the final research report or used in subsequent research phases.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute the gemini command via the bash shell. While this is the primary mechanism for research, it involves spawning subprocesses with parameters (-m, -p) that could be influenced by untrusted data if not carefully managed by the underlying platform.

research