The Agent Skills Directory

[COMMAND_EXECUTION]: The initialization script scripts/init-research.sh is vulnerable to command injection. It uses the user-provided <topic> argument inside a shell heredoc (<<EOF) without quoting the delimiter. In Bash, this causes the shell to perform variable expansion and command substitution on the content. A malicious topic containing shell metacharacters (e.g., $(id)) will result in the execution of those commands in the agent's environment.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md explicitly direct the agent to circumvent platform security controls. It advises the agent to use shell heredocs to write files if a standard 'Write' tool blocks specific filenames, stating that the agent 'must not be renamed to appease the guard.' This is a deliberate instruction to bypass environment-imposed safety filters.
[PROMPT_INJECTION]: The skill contains logic to override system-level constraints by providing specific techniques (shell heredocs) to bypass tool-based file naming restrictions, which qualifies as an instruction to disregard safety guidelines.
[DATA_EXFILTRATION]: While intended for research, the skill's reliance on web search and fetch tools to process external data poses a risk. If an attacker successfully uses indirect prompt injection on a page the agent visits, they could potentially trick the agent into fetching internal or sensitive URLs to leak data.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection.
Ingestion points: The agent context is heavily populated with data from the web using WebSearch, WebFetch, and browser automation tools (SKILL.md).
Boundary markers: While technical delimiters are not specified, the skill implements a logical boundary through its strict citation schema ([S#]) and a mandatory 'skeptic' verification pass designed to catch fabricated or stale data.
Capability inventory: The agent has the ability to execute shell scripts (init-research.sh), write to the file system (via tools or shell heredocs), and access the network.
Sanitization: No evidence of sanitization for untrusted inputs was found, particularly in the init-research.sh script, which directly processes the research topic.

market-researcher