The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it is designed to ingest and process untrusted data from the web.
Ingestion points: The skill uses mcp_web-search-prime_search, mcp_web-reader_read, and mcp_zread_read to fetch external content from the internet (as documented in SKILL.md).
Boundary markers: There are no instructions to use delimiters or 'ignore embedded instructions' warnings when processing fetched content.
Capability inventory: The skill has access to powerful tools including Bash, mcp_gemini-bridge, and mcp_codex-bridge.
Sanitization: No evidence of sanitization or validation of the fetched content before it is processed.
[COMMAND_EXECUTION]: The skill's metadata includes Bash in the allowed-tools list. While the provided instructions do not demonstrate the use of this tool, granting access to a shell environment for a research task provides a broad capability that could be exploited.
[EXTERNAL_DOWNLOADS]: The skill utilizes several tools (WebFetch, mcp_web-reader, mcp_zread) to download and read content from external, untrusted websites as part of its core research function. While functional, this represents the primary entry point for untrusted data.

research-and-synthesis