The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill relies on an external 'NotebookLM connector plugin' that is not bundled with the skill. Users are instructed to download this plugin from a GitHub repository, run npm install, and the agent is then instructed to execute it using node. Specifically, the cti-search.md slash command executes node ~/.claude/plugins/notebooklm-connector/index.js with parameters derived from search results.
Evidence: SKILL.md (NotebookLM Integration section) and cti-search.md.
[EXTERNAL_DOWNLOADS]: The skill's installation process and various README files encourage the user to clone external repositories from GitHub to enable additional functionality. One repository belongs to the skill's author (Security-Phoenix-demo), while others use placeholders like YOUR_USERNAME.
Evidence: README.md and the Readme build notes.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform several operations, including installing itself, checking for plugin presence, and calling the Node.js connector script. The command line constructed for the NotebookLM push includes subshells and environment variables which, while quoted, bridge data from external search results to a local shell execution.
Evidence: install.sh and cti-search.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from over 300 curated external security domains to generate summaries, IOC extracts, and TTP mappings. This creates a significant ingestion surface for malicious instructions embedded in web content.
Ingestion points: Web search results from domains listed in cti-domains.txt (SKILL.md).
Boundary markers: Absent; the skill instructions do not specify delimiters or instructions to ignore embedded commands within the search results.
Capability inventory: The skill possesses Bash and WebSearch capabilities, and routinely passes search result URLs to a shell-executed script (cti-search.md).
Sanitization: Absent; there is no explicit instruction to sanitize or validate the content retrieved from external domains before it is processed by the agent.
[PERSISTENCE]: The install.sh script installs a custom slash command and reference data into the ~/.claude/ directory. This modifies the agent's environment to persist the skill's functionality across sessions.
Evidence: install.sh copying files to $HOME/.claude/commands.

cti-domain-research