The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it is fundamentally designed to retrieve and process untrusted data from the internet.
Ingestion points: Data is fetched from arbitrary URLs, search results, and YouTube transcripts via WebFetch, fabric, and specialized scraping MCPs in Workflows/Retrieve.md and Workflows/YoutubeExtraction.md.
Boundary markers: The workflows lack explicit instructions or delimiters in their prompts to ensure that the agent ignores any instructions embedded within the retrieved content.
Capability inventory: Researcher agents (GeminiResearcher, DeepResearcher) used for synthesis have the capability to influence local filesystem writes in the history directory and subsequent logic flows.
Sanitization: There is no evidence of content sanitization or filtering before the ingested data is passed to the LLM for analysis.
[COMMAND_EXECUTION]: The skill performs various command-line operations for its core functionality.
Evidence: SKILL.md uses curl to send JSON payloads to a local notification service at localhost:8888.
Evidence: Workflows/Fabric.md and Workflows/YoutubeExtraction.md execute the fabric CLI for content analysis and transcription tasks.
Evidence: Workflows/ExtensiveResearch.md and UrlVerificationProtocol.md use curl to perform HTTP status checks on external URLs during mandatory link verification.
[EXTERNAL_DOWNLOADS]: The skill programmatically downloads external dependencies to maintain its toolset.
Evidence: Workflows/Fabric.md executes a git clone command to download the fabric-project/fabric repository from GitHub if the directory is missing, ensuring the latest patterns are available for the agent.

Research