The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from the internet via the fetch_urls parameter and automated web searches.
Ingestion points: External web content is retrieved in run.py via the _fetch_page function and the tavily_search tool.
Boundary markers: The skill does not use delimiters (e.g., XML tags or triple quotes) or system instructions to warn the agent that the fetched content may contain malicious commands.
Capability inventory: The skill requires bash access as defined in SKILL.md, which could be exploited if an injection succeeds.
Sanitization: Content sanitization is limited to stripping HTML tags using regular expressions in run.py, which does not prevent natural language instruction injection.
[DATA_EXFILTRATION]: The skill performs network operations to non-whitelisted external domains.
Evidence: In run.py, the skill uses urllib.request.urlopen to fetch arbitrary URLs provided by the user or found during search.
Evidence: It utilizes the Tavily Search API to perform multi-source queries, which involves sending search terms to an external service.

deep-research