The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill architecture relies on ingesting untrusted data from the web and processing it through multiple subagent phases (synthesis and verification).
Ingestion points: Untrusted data enters the agent context via web_search and web_extract tools within subagents during Phase 2. This content is saved to findings files (e.g., .omh/research/{slug}-findings/*.md).
Boundary markers: The instructions for Phase 4 and Phase 5 specify inlining findings into the context field of the delegate_task call without recommending boundary markers (like XML tags or specific delimiters) or instructions for the subagent to ignore embedded commands within the findings.
Capability inventory: The parent skill has significant capabilities, including persistent state management via omh_state, filesystem write/read access to the .omh/ directory, and the ability to delegate further tasks.
Sanitization: There is no mention of sanitizing or escaping the web-extracted content before it is concatenated and inlined into the prompt context for the synthesist and verifier subagents.

omh-deep-research