The Agent Skills Directory

[COMMAND_EXECUTION]: The fetch_content tool is designed to clone GitHub repositories and provides the agent with a local path to explore using bash and read commands. This creates a significant risk of remote code execution if a user-requested or automatically fetched repository contains malicious scripts or configuration files.
[PROMPT_INJECTION]: The skill instructions explicitly require the agent to always include workflow: "none" in tool calls to bypass interactive browser curator popups. This concealment pattern intentionally reduces user oversight and suppresses confirmation mechanisms that might otherwise allow a user to review or block suspicious search actions.
[EXTERNAL_DOWNLOADS]: The fallback mechanism utilizes curl to perform network requests to an external search API at https://deepapi.co/v1/search/web. This introduces external network dependencies and transmits queries to a third-party service outside of the standard tool chain.
[PROMPT_INJECTION]: The skill demonstrates a high exposure to Indirect Prompt Injection due to its primary function of ingesting and processing untrusted data from the web, GitHub, and document formats without adequate security boundaries.
Ingestion points: Web search results, full web page content, cloned GitHub repository files, extracted PDF text, and YouTube transcripts are ingested via web_search, code_search, and fetch_content as described in SKILL.md.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to ignore or isolate instructions potentially embedded within the fetched data.
Capability inventory: The agent is granted access to powerful capabilities including bash execution, file reading, and network operations via curl as specified in SKILL.md.
Sanitization: Absent. There is no evidence of content filtering, escaping, or validation to prevent retrieved data from influencing the agent's logic or command execution.

pi-web-search