The Agent Skills Directory

[COMMAND_EXECUTION]: The agent executes build_artifact.py using the Bash tool to process research data and interact with the Fireworks API.
[EXTERNAL_DOWNLOADS]: The skill retrieves external content from user-specified URLs and communicates with the Fireworks chat completions API (api.fireworks.ai) to generate the survey text. This is consistent with its primary function and utilizes well-known service providers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the web which could contain adversarial instructions. This surface is well-mitigated by multiple defense layers:
Ingestion points: Data is fetched from the source_url provided by the user (Step 1 of the workflow) and incorporated into a research bundle.
Boundary markers: The build_artifact.py script utilizes a dedicated system prompt that explicitly instructs the generator model to treat all research bundle fields as data and never as instructions.
Capability inventory: The skill leverages WebFetch for data retrieval, Bash for script execution, and Write for artifact generation.
Sanitization: The generator script employs a custom HTMLParser to validate the resulting HTML, stripping active content such as scripts, iframes, and event handlers, while injecting a restrictive Content Security Policy (CSP) meta tag to prevent unauthorized code execution or navigation in the final artifact.

survey-generator