The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches and summarizes external markdown content from LeetCode Discuss posts, which is an untrusted source.
Ingestion points: Content is retrieved via script/lc_discussion.py fetch from leetcode.com/discuss/ in Step 3.
Boundary markers: The instructions do not define explicit delimiters or instructions to the agent to ignore potentially malicious commands embedded in the fetched posts.
Capability inventory: The skill is granted Bash, Read, Write, Glob, and Grep tools, enabling it to execute scripts and write to the filesystem.
Sanitization: While the skill advises the agent to summarize and avoid republishing whole posts, there is no technical sanitization of the fetched data before it enters the agent's context.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the Bash tool, incorporating user-supplied keywords directly into the command arguments.
Evidence: Steps 1, 3, and 5 involve running python3 script/lc_discussion.py with parameters like <keywords> and <topic ids> provided by the user or extracted from previous steps. If these inputs are not properly handled by the agent, they could introduce command injection risks.

lc-discussion