The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration logic in SKILL.md (Phase 3) instructs the agent to execute a shell command: echo '<the JSON array>' | python3 [SKILL_DIR]/scripts/validate_sources.py. Because the JSON array contains 'claims' and 'leads' gathered from external web sources during previous phases, an attacker can provide content containing shell metacharacters (like single quotes) to break out of the echo string and execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The citation validation script (scripts/validate_sources.py) is capable of making network requests via urlopen and reading local files via open(). These capabilities can be abused if a malicious website provides 'leads' that point to sensitive local file paths or internal network services (SSRF), allowing an attacker to confirm their existence or probe their contents through the validation results.
[PROMPT_INJECTION]: The skill implements a multi-step research pipeline that ingests data from untrusted external sources (web pages, documentation, academic papers). There are no explicit boundary markers or sanitization steps to prevent instructions embedded in this external data from influencing the agent's behavior in later phases (Indirect Prompt Injection). For example, a website could instruct the 'Scout' or 'Investigator' agents to prioritize malicious leads.
Ingestion points: External content is fetched using WebSearch and Read tools in Phase 1 (SCOUT) and Phase 2 (INVESTIGATE) as defined in SKILL.md.
Boundary markers: Absent; content is interpolated directly into subagent prompts without delimiters.
Capability inventory: The skill uses bash to run a Python script (scripts/validate_sources.py) that possesses both file system and network access capabilities.
Sanitization: No escaping or validation is performed on findings or leads before they are passed to the shell environment.

rabbit-hole