The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted external content while possessing broad project-level permissions.
Ingestion points: The skill processes content from YouTube transcripts via the transcribe tool, as well as external articles, documentation, and GitHub repositories.
Boundary markers: The instructions lack specific delimiters or instructions to the agent to treat external content as untrusted or to disregard embedded instructions.
Capability inventory: The skill has permissions to read the entire project structure and source code, write report files, modify existing backlog files, and perform Git operations including checkout, commit, and push.
Sanitization: There is no mechanism described for sanitizing or filtering the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill utilizes shell commands and external tool invocations to fulfill its research and persistence tasks.
Evidence: It invokes the transcribe tool via Bash to fetch content from video URLs.
Evidence: It executes Git commands including git checkout, git add, git commit, and git push to save research results to the project repository.
[EXTERNAL_DOWNLOADS]: The skill fetches and analyzes content from arbitrary user-provided URLs.
Evidence: Phase 2 describes fetching and reading data from YouTube, articles, documentation, and GitHub repositories.

research-scout