The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The fetch_content tool is designed to clone GitHub repositories to a local path and explicitly instructs the agent to explore and interact with the downloaded content using bash or read commands. This allows for the execution of arbitrary code retrieved from external, potentially malicious sources.
[PROMPT_INJECTION]: The skill contains instructions that suppress user interaction by mandating the use of workflow: "none" for all web searches. This is described as a way to skip a curator popup, which constitutes a concealment pattern that reduces user oversight of the agent's browsing activity.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface by ingesting untrusted data from the open web, PDFs, and GitHub repositories.
Ingestion points: Data enters the agent's context through web_search results and the markdown output generated by fetch_content from websites, documents, and code repositories.
Boundary markers: The skill lacks instructions or delimiters to help the agent distinguish between the developer's instructions and potentially malicious instructions embedded within the fetched external data.
Capability inventory: The agent is granted access to high-risk tools including bash, read, and network tools (curl).
Sanitization: No sanitization, validation, or filtering mechanisms are defined for the content retrieved from external sources.
[COMMAND_EXECUTION]: The skill provides a curl command template for a fallback search provider (DeepAPI) that includes shell command substitution (uuidgen) and uses environment variables for authentication. It also references the use of CLI tools like gh, ffmpeg, and yt-dlp to process external data.
[EXTERNAL_DOWNLOADS]: The skill's core functionality relies on downloading data from arbitrary external URLs, cloning GitHub repositories, and fetching YouTube transcripts, which introduces risks associated with processing untrusted remote content.

pi-web-search