The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill connects to a remote Model Context Protocol (MCP) server at https://unbrowse.ai/mcp/sec.gov to provide its functionality.\n- [COMMAND_EXECUTION]: Instructions provide commands to add the MCP server using the Claude CLI and install the skill via npx, which involves downloading and running code from the vendor's infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from SEC filings. Analysis of the attack surface indicates: 1. Ingestion points: Results from the sec_gov__get_latest_search_index tool. 2. Boundary markers: No explicit instructions for delimiters or instruction-ignoring warnings are present. 3. Capability inventory: The skill possesses high-privilege capabilities including browser automation (unbrowse.browse.act) and general task execution (unbrowse.run). 4. Sanitization: No sanitization of external content is described.\n- [DYNAMIC_EXECUTION]: The Unbrowse service supports dynamic tool creation, where recording browser actions on sec.gov results in the compilation of new tools that are subsequently available to the agent.\n- [SAFE]: The documentation provides clear security guidance for managing authentication, advising the use of secret managers for the UNBROWSE_API_KEY and cautioning against hardcoding secrets in configuration files.

sec