The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions to perform filesystem operations and retrieve external code using shell commands, specifically mkdir -p /mnt/d/githubresearch and git clone [repo-url] in SKILL.md. While the instructions mandate asking for user permission before cloning, the use of a dynamically discovered [repo-url] in a shell command string presents a theoretical risk of command injection if the agent does not sanitize the input before execution.- [EXTERNAL_DOWNLOADS]: The research process relies heavily on external data retrieval via WebSearch, WebFetch, and a documented fallback using curl targeting https://r.jina.ai/. The reference to Jina AI is a well-known service for LLM content processing. The skill also facilitates the download of entire codebases via git clone.- [PROMPT_INJECTION]: The skill exhibits an attack surface for Indirect Prompt Injection (Category 8) as it is designed to ingest and summarize large volumes of untrusted data from the web and third-party repositories.
Ingestion points: Web results via WebSearch, full page content via WebFetch and curl, and source code via git clone.
Boundary markers: The instructions lack specific requirements for using boundary markers or 'ignore' instructions when the agent processes retrieved text, increasing the risk of the agent obeying hidden instructions in the data.
Capability inventory: The skill possesses network access, filesystem write access, and the ability to interact with external version control systems.
Sanitization: No explicit sanitization or filtering logic is provided for the content retrieved before it is passed to the synthesis and reporting phases.

deep-research