The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves fetching and processing content from external, untrusted sources which can lead to the agent following malicious instructions embedded in that data.
Ingestion points: Untrusted data enters the agent context during Phase 1 (Collect) via the /read skill, WebFetch, or curl, targeting arbitrary URLs, GitHub repositories, and platform-specific content (WeChat, Feishu).
Boundary markers: The instructions lack explicit boundary markers or specific "ignore embedded instructions" directives to prevent the agent from executing commands found within the fetched research materials.
Capability inventory: The skill possesses capabilities for network operations (curl, WebFetch), file system modification (moving and indexing files into sub-topic directories), and calling external plugins (PipeLLM).
Sanitization: There is no evidence of input sanitization or validation for the content retrieved from external URLs before it is processed in the "Digest" and "Fill In" phases.
[EXTERNAL_DOWNLOADS]: The skill explicitly instructs the agent to download content from the internet using curl and WebFetch during its collection phase.
[COMMAND_EXECUTION]: The skill fallback mechanism instructs the agent to execute the curl command directly to fetch web content if a specialized reading skill is not present.

learn