The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It is designed to fetch content from an arbitrary user-provided URL (source_url) as described in the SKILL.md workflow. This retrieved content is used to populate a research bundle that is then directly interpolated into a prompt for the Kimi K2.6 model in build_artifact.py. The implementation lacks explicit sanitization of the fetched text and does not utilize robust boundary markers or instructions to the model to ignore potential malicious directives contained within the external data.
Ingestion points: External content is fetched via the WebFetch tool using the source_url parameter defined in Step 1 of SKILL.md.
Boundary markers: The prompt template in build_artifact.py does not employ specific delimiters or "ignore embedded instructions" warnings to encapsulate the untrusted research bundle content.
Capability inventory: The skill has Write permissions to create HTML artifacts on the local filesystem and performs network POST requests to an external API.
Sanitization: No sanitization or validation of the fetched external text is performed before it is passed to the LLM context.
[EXTERNAL_DOWNLOADS]: The Python script build_artifact.py makes network requests to https://api.fireworks.ai/inference/v1/chat/completions. This outbound connection targets a well-known AI service provider and is a legitimate part of the skill's intended workflow for generating research artifacts.

survey-generator