The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents a high surface area for indirect prompt injection (Category 8) as it is designed to ingest and process untrusted data from multiple sources.
Ingestion points: External data enters the context via scripts/read-research.py, the read tool in sub-agents, and the webfetch tool in the web-searcher agent.
Boundary markers: No specific delimiters or "ignore previous instruction" markers are defined for isolating processed content.
Capability inventory: The skill possesses file write permissions (todowrite, promote-research.py), local command execution (gather-metadata.py), and network access (webfetch).
Sanitization: No sanitization or filtering of external markdown or code content is implemented before it is processed by the agents.
[COMMAND_EXECUTION]: The scripts/gather-metadata.py script uses subprocess.run to execute local git commands. While the command list is static, it interacts directly with the local environment to retrieve repository configuration.
[DATA_EXFILTRATION]: The skill gathers Git metadata, including potentially sensitive repository remote URLs. The web-searcher component's webfetch tool provides a potential channel for data transmission to external domains, although it is a primary functional requirement.
[EXTERNAL_DOWNLOADS]: The web-searcher agent fetches content from external web sources. This involves retrieving and processing data from potentially untrusted third-party domains.

researching-codebases