The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables retrieval of external data from arbitrary websites via Tavily and Exa extraction apps. As demonstrated in the LLM research workflow, this content is intended to be processed by an agent. This creates an attack surface where malicious instructions embedded in external web pages could influence the agent's logic.
Ingestion points: Content is ingested from the web via tavily/search-assistant, tavily/extract, exa/search, and exa/extract apps (SKILL.md).
Boundary markers: The provided examples use informal markers like <search-results> and <content>, but do not include explicit system instructions to ignore embedded commands within the extracted data.
Capability inventory: The skill has access to the Bash tool restricted to the belt CLI, which allows for further search, extraction, and local file writing (> search_results.json).
Sanitization: No explicit sanitization or filtering of the extracted web content is defined in the instructions.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the belt CLI tool and additional capability modules from the vendor's infrastructure, including npx skills add belt-sh/cli and downloads from the inference-sh GitHub organization.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to execute belt CLI commands. The allowed-tools configuration specifically limits this access to the belt binary, implementing a principle of least privilege for shell interactions.

web-search