The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources (YouTube descriptions, website content) and incorporates it into a research synthesis prompt for the LLM.
Ingestion points: External content is fetched in SKILL.md (Step 2) using yt-dlp and WebFetch tools.
Boundary markers: The skill uses <research> XML-style tags in references/prompts.md (Phase 1) to delimit untrusted content, which provides some protection but is not foolproof against adversarial input.
Capability inventory: The agent has access to shell commands (yt-dlp, curl, python3), the ability to install Python packages (weasyprint), and file system write permissions for PDF generation.
Sanitization: There is no evidence of sanitization or filtering of the scraped text before it is passed to the LLM.
[COMMAND_EXECUTION]: The script scripts/generate_pdf.py uses os.system() to attempt a runtime installation of the weasyprint library. While the package name is hardcoded to a well-known library, the use of os.system for dependency management is a pattern that can be risky if expanded to include variable input.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs the weasyprint Python package from the public PyPI registry and uses yt-dlp to fetch metadata and thumbnails from YouTube. These are standard operations for the skill's functionality and involve well-known, reputable software components.

ebook