The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses a Python script (scripts/atoms-search.py) to connect to the vendor-controlled API at https://api.xyskill.xyz to retrieve knowledge base "atoms".
[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute a shell script (scripts/xy-init.sh) for initialization and a Python script (scripts/atoms-search.py) for searching the knowledge base.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied information to build a business profile and uses user keywords in command-line search queries, creating a potential injection surface.
Ingestion points: User input is ingested during the profile creation process and subsequent coaching interactions (SKILL.md).
Boundary markers: The skill lacks explicit instructions for the agent to sanitize or delimit user input before passing it to internal scripts.
Capability inventory: The skill has the capability to execute bash and Python scripts with arguments derived from user interaction.
Sanitization: The atoms-search.py script performs basic string splitting but does not sanitize for shell-specific special characters, relying on the host agent's execution environment.

xy-coach