The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run to execute external binaries, including git clone for repository ingestion and pdftotext for PDF extraction. These commands are executed with arguments derived from the input manifest file.
[DATA_EXFILTRATION]: The _resolve_local_locator function allows the resolution of absolute file paths. If a locator in the sources/manifest.yml points to a sensitive local file (e.g., /etc/passwd), the skill will read that file and save its content into the workspace's normalized output directory.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch data from arbitrary remote URLs using urllib.request and git clone. This includes fetching HTML pages, JSON data from APIs (such as Bilibili), and binary assets like PDFs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external, untrusted sources which are then formatted as Markdown for downstream agent processing.
Ingestion points: Remote URLs and local paths defined in sources/manifest.yml (scripts/run.py).
Boundary markers: The skill wraps ingested content with basic Markdown headers and a source locator string, but does not use robust delimiters or specific instructions to ignore embedded commands.
Capability inventory: Across its scripts, the skill can execute subprocesses, perform network operations, and write files to the filesystem.
Sanitization: The skill performs basic whitespace normalization and HTML tag stripping but lacks validation or filtering to remove potential prompt injection instructions from the ingested text content.

source-ingest