The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by loading templates from references/research-backends.md and substituting {url} or {query} placeholders. It then executes these commands directly via system binaries (e.g., yt-dlp, perplexity). This direct substitution of data into a command string creates a significant command injection vulnerability if the URLs or search queries contain malicious shell metacharacters.
[DYNAMIC_EXECUTION]: The skill performs runtime assembly of command lines via string interpolation of parameters into arbitrary command templates (invoke) specified in configuration files, and also dynamically invokes the ${QMD_CLI:-qmd} tool with variable parameters.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface due to the following characteristics:
Ingestion points: Processes untrusted web data retrieved via WebSearch and WebFetch during multi-round research, as well as vault configuration files.
Boundary markers: No boundary markers or delimiters are specified to isolate untrusted web data from instructions or to prevent malicious content from manipulating the agent's behavior.
Capability inventory: Has the capability to execute external CLI commands via the backend registry and run qmd index updates.
Sanitization: Lacks any input validation or sanitization mechanisms before interpolating external strings into the command execution template.

wiki-research