The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted full-text content from external biology preprints. This data is ingested into the agent's context and could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: Search results retrieved from the Valyu API search endpoint in scripts/search.mjs.
Boundary markers: The results are structured in JSON, but the skill lacks explicit delimitation or instructions for the agent to ignore embedded commands within the retrieved preprint text.
Capability inventory: The skill possesses network access via fetch() and file system write access to the user's home directory (specifically ~/.valyu/config.json).
Sanitization: No filtering or sanitization is applied to the retrieved preprint content before it is returned to the agent.
[COMMAND_EXECUTION]: The skill documentation instructs the agent to execute a local shell script (scripts/search) to perform searches and handle API configuration.
Evidence: The SKILL.md file contains several examples of bash commands and specific instructions for the agent to run the script to interact with the service and save user-provided API keys.

biorxiv-search