The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation directs users to install the ddgs package via pip. On the Python Package Index (PyPI), ddgs is a separate and unrelated package from the widely-used duckduckgo-search library (which provides the ddgs CLI utility). Recommending the installation of an unrelated package with the same name as the intended tool's command-line interface introduces a significant supply chain risk.
[METADATA_POISONING]: The skill contains a deceptive claim in the 'Pitfalls' section of SKILL.md, stating that the ddgs package was 'previously duckduckgo-search'. This misinformation encourages the installation of the wrong dependency and obscures the actual source of the software.
[INDIRECT_PROMPT_INJECTION]: The skill processes search results from DuckDuckGo, creating an attack surface for malicious instructions embedded in external web content.
Ingestion points: Untrusted search snippets are ingested through the ddgs CLI and Python API as shown in SKILL.md and scripts/duckduckgo.sh.
Boundary markers: No specific delimiters or 'ignore' instructions are used to isolate search result content from the agent's instructions.
Capability inventory: The skill utilizes terminal and execute_code capabilities to perform searches and process data.
Sanitization: The skill does not mention or implement sanitization or filtering of the retrieved search results.

duckduckgo-search