The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes and summarizes untrusted data from various public web platforms.
Ingestion points: Data is retrieved from external sources such as Twitter, Reddit, and Hacker News in SKILL.md (Steps 3a and 4).
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potentially malicious commands embedded in the retrieved web data when generating AI briefings in Step 6.
Capability inventory: The skill possesses the ability to execute shell commands, run a local Node.js script, and perform network requests via Tavily.
Sanitization: No explicit sanitization or filtering of the retrieved web content is documented before the data is interpolated into prompts.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands and a local script to perform its core functions.
Evidence: SKILL.md (Step 1) uses bash scripts to check for the presence of required environment variables like TAVILY_API_KEY and GITHUB_TOKEN.
Evidence: SKILL.md (Step 5) executes the bundled script node scripts/heat-score-calc.mjs to process company signal data and generate scores.
[EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for installing components from external sources associated with the author.
Evidence: README.md suggests installation using npx from the @opendirectory.dev package scope and downloading content from the Varnan-Tech GitHub organization.

company-radar