The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes untrusted external content from the web during the drill-down and research phases.
Ingestion points: Untrusted data enters the session via web_researcher.py (which uses crawl4ai) and the /concept:research slash command.
Boundary markers: All external content in research artifacts (WR-xxx.md) is enclosed in  and  tags.
Capability inventory: The skill utilizes Write and Read tools for local workspace management and executes Python scripts for session tracking.
Sanitization: web_researcher.py implements a _sanitize_content function that uses regex patterns to identify and redact injection vectors like role-switching ('system:', 'user:'), instruction overrides ('ignore previous instructions'), and jailbreak keywords.
[EXTERNAL_DOWNLOADS]: The skill relies on the crawl4ai Python package for its primary research functionality.
README.md and command definitions provide clear instructions for installation from PyPI.
web_researcher.py includes a mechanism to re-execute itself using a pipx virtual environment interpreter, featuring a prefix validation check to ensure the interpreter path is within the expected user-local directory.
[COMMAND_EXECUTION]: Local Python scripts are used extensively for state and metadata management.
All scripts (update_state.py, source_tracker.py, assumption_tracker.py, etc.) include a _validate_path function that uses os.path.realpath and relative path checking to prevent path traversal vulnerabilities when accessing session files.

concept-dev