The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses imperative language ("CRITICAL", "MUST", "No exceptions") to override standard tool behavior by forcing the agent to set workflow: "none", which is designed to suppress interactive browser curator popups and reduce user oversight.
[COMMAND_EXECUTION]: The skill provides a shell-based fallback mechanism using curl to query the DeepAPI service. It also explicitly suggests that the agent use read or bash to explore local directories containing cloned content from GitHub repositories.
[DATA_EXFILTRATION]: The skill instructs the agent to transmit an environment variable containing a sensitive credential ($DEEPAPI_API_KEY) to an external, non-whitelisted domain (deepapi.co) via a shell command.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection:
Ingestion points: Processes untrusted external data from search result synthesized answers, raw web page markdown, PDF-to-markdown extracts, and YouTube transcripts.
Boundary markers: There are no instructions provided to use delimiters or warnings to ignore instructions embedded within the fetched content.
Capability inventory: The skill has access to shell execution (bash), file reading (read), and network operations (curl), which could be leveraged if the agent obeys instructions found in the external data.
Sanitization: No sanitization or validation of the fetched content is specified before the data is processed or stored.
[EXTERNAL_DOWNLOADS]: The skill performs remote data acquisition beyond standard API calls, including cloning repositories from GitHub and extracting transcripts and frames from YouTube videos using external utilities.

pi-web-search