The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external web searches and the local codebase, creating a surface for indirect prompt injection.
Ingestion points: Data is ingested via the web_search tool and read_file tool as defined in agents/openai.yaml and SKILL.md.
Boundary markers: The system prompt in agents/openai.yaml lacks explicit instructions to treat retrieved data as untrusted or to ignore instructions embedded within it.
Capability inventory: The agent has permissions for network access (https://*) and local file writes to ./artifacts and ./research-reports.
Sanitization: No specific sanitization or validation logic is present in the provided scripts or prompts to handle adversarial content in search results.

researcher