The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process content from arbitrary external websites via WebFetch, the Tavily API, and browser automation. Because this content is untrusted and the agent has access to powerful tools like Bash and file system operations, there is a risk that malicious instructions embedded in web pages could influence the agent's behavior.\n
Ingestion points: WebFetch calls in SKILL.md, agent-browser operations in rules/browser-patterns.md, and Tavily API responses in references/tavily-api.md.\n
Boundary markers: The skill does not provide instructions to wrap external content in delimiters or warn the agent to ignore embedded commands.\n
Capability inventory: The skill allows access to Bash, Read, and Write tools, enabling shell command execution and file modification based on processed data.\n
Sanitization: No explicit sanitization or filtering of fetched content is defined before it is returned to the agent context.\n- [DATA_EXFILTRATION]: While not actively exfiltrating data to an external attacker, the skill suggests saving browser session states (which include sensitive authentication tokens and cookies) to the /tmp directory (rules/browser-patterns.md). On many shared systems, /tmp is world-readable, which could allow other local users to access and use the session data.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the Tavily API (api.tavily.com) to perform semantic searches and extract page content. Tavily is a well-known service for AI-powered web research, and its use here is consistent with the skill's intended purpose.

web-research-workflow