The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content from external sources (PubMed articles via the Valyu API) and exposes an indirect prompt injection attack surface.
Ingestion points: Untrusted external data enters the agent context in scripts/search.mjs through the searchPubMed function, which fetches text content (data.results) from https://api.valyu.ai/v1/search.
Boundary markers: Absent. There are no explicit boundaries, delimiters, or guidelines in SKILL.md or the scripts telling the agent to ignore any potential instructions embedded inside the retrieved biomedical articles.
Capability inventory: The script scripts/search.mjs possesses network operation capabilities via native fetch and file system access/modification capabilities to manage its configuration directory (~/.valyu/config.json).
Sanitization: Absent. The external results are returned and printed to standard output directly as raw text JSON strings without filtering or sanitizing for malicious prompt structures.

pubmed-search