The Agent Skills Directory

PROMPT_INJECTION (LOW): The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from the local filesystem.
Ingestion points: The skill reads content from RESEARCH.md and track-specific markdown files to extract links and evidence chains.
Boundary markers: None. There are no instructions or delimiters defined to prevent the agent from following instructions that might be embedded within the research data or track files.
Capability inventory: The skill has access to the Bash, Edit, Read, Glob, and Grep tools. These provide a high-impact execution path if the agent is successfully manipulated by data-embedded instructions.
Sanitization: No sanitization or validation logic is present to filter executable instructions or malicious patterns from the data being read.
COMMAND_EXECUTION (SAFE): The skill includes Bash in its allowed-tools list. However, the instructions do not contain hardcoded shell commands or dynamic command construction patterns that would indicate malicious intent.

verify-sources