The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_market_visuals.py uses subprocess.run to automate the generation of market diagrams. It programmatically constructs commands to call Python scripts from other local skills (scientific-schematics and generate-image). While it uses a list for command arguments to prevent shell injection, the capability to spawn subprocesses is a significant permission.
[EXTERNAL_DOWNLOADS]: The skill's workflow relies on the research-lookup tool to fetch market statistics and industry data from remote sources (e.g., Gartner, IDC, and government reports). This results in the processing of untrusted remote content within the agent's context.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data and possesses powerful capabilities.
Ingestion points: External industry data is ingested through the research-lookup skill as described in SKILL.md.
Boundary markers: The prompt instructions do not include explicit delimiters or safety instructions to prevent the agent from following commands that might be hidden within the fetched research data.
Capability inventory: The skill is granted Bash, Write, Read, and Edit permissions, and includes utility scripts that execute subprocesses.
Sanitization: No validation or sanitization of external research content is performed before it is integrated into the LaTeX report generation process.

market-research-reports