The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill demonstrates a vulnerability surface for indirect prompt injection due to its multi-step research architecture.
Ingestion points: Data enters the agent's context through the web_search tool used by subagents, which is then saved into local markdown files (e.g., research_[topic_name]/findings_[subtopic].md) using write_file.
Boundary markers: The instructions lack any requirement for boundary markers (like XML tags or delimiters) or 'ignore embedded instructions' warnings when the main agent processes these findings.
Capability inventory: The skill utilizes task (spawning subagents), write_file (writing local data), read_file (reading local data), and fetch_url (outbound network access).
Sanitization: There is no evidence of content sanitization or validation before the fetched data is synthesized into the final response.
Data Exposure & Exfiltration (LOW): While the skill primarily handles research data, the combination of read_file (local file access) and fetch_url (outbound networking) creates a potential path for data movement. However, no malicious patterns or sensitive file path accesses were detected.

web-research