The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install external components using commands like npx skills add belt-sh/cli and references instructions hosted at a remote URL: https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md.
[REMOTE_CODE_EXECUTION]: The skill relies on the belt app run command to execute remote applications (e.g., tavily/search-assistant, falai/flux-dev-lora, exa/search) hosted and managed by external providers.
[COMMAND_EXECUTION]: The YAML frontmatter grants the agent Bash(belt *) capabilities, allowing it to execute arbitrary shell commands using the belt CLI tool, which is necessary for the skill's primary functions but increases the potential impact of an exploit.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting untrusted data from external sources and processing it within the agent context.
Ingestion points: Research results fetched via belt app run tavily/search-assistant and belt app run exa/search are incorporated into the persona creation workflow in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the fetched search data.
Capability inventory: The agent has permission to execute shell commands via Bash(belt *) as specified in SKILL.md.
Sanitization: There is no evidence of filtering, escaping, or validation of external search results before they are processed by the agent.

customer-persona