The Agent Skills Directory

[COMMAND_EXECUTION]: The skill exhibits self-modifying behavior by using swan-update-skill to dynamically rewrite its own 'Setup state' instructions in SKILL.md after the initial configuration is completed. This changes the agent's operating logic for future executions.
[COMMAND_EXECUTION]: The skill utilizes swan-execute-code to handle data processing tasks, such as domain deduplication and hard re-filtering, specifically when handling batches larger than 50 rows.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via its research sub-agents which are instructed to visit and extract data from external domains.
Ingestion points: Untrusted data is ingested when swan-delegate-to-sub-agents visits external websites ({domain}) and when swan-fetch-businesses retrieves data from external providers like Apollo or Apify.
Boundary markers: The sub-agent prompt template uses basic instruction-based delimitation but lacks robust escaping or 'ignore' directives for the interpolated external content.
Capability inventory: The skill environment includes tools for arbitrary code execution (swan-execute-code) and instruction modification (swan-update-skill).
Sanitization: No explicit sanitization, validation, or content filtering is described for the data retrieved from external domains before it is used to drive sub-agent decisions or code-based data processing.

build-list