The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources that are not under the user's control, such as web searches and social media platforms, creating a surface for indirect prompt injection.
Ingestion points: The SKILL.md file specifies that the agent should use "universal search + platform channels (X/Reddit/Podcasts)" and read first-party sources including documentation and source code.
Boundary markers: The instructions recommend cross-referencing and treating social media as "clues," but there are no explicit instructions to use delimiters or "ignore embedded instructions" markers when recording this external data in the research log.
Capability inventory: The skill has high-privilege capabilities including modifying project code (via the implement tool), writing and executing local scripts for experiments, and performing network operations.
Sanitization: There is no description of sanitization or escaping of external content before it is processed by the subagents or recorded in logs.
[DYNAMIC_EXECUTION]: The skill instructions explicitly direct the agent to "run experiments, write measurement scripts, and modify code to verify hypotheses" (跑实验、写测量脚本、改代码验证假设). This involves the generation and execution of arbitrary code at runtime.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands and scripts to perform "取证执行" (evidence gathering) and experimental verification. While delegated to an implementation track, these actions result in local system modifications.
[DATA_EXPOSURE]: The agent is tasked with establishing context by reading internal project source code, existing research logs, and environment configurations (docs/research/, .harness/), which exposes internal intellectual property to the research process.

autoresearch