The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection as its primary function is to ingest and process untrusted data from external web sources. This risk is effectively managed through the following architecture:
Ingestion points: Data enters the system during 'Wave 1: Broad Sweep' and 'Wave 2: Deep Dive' through various search and scraping MCP tools specified in SKILL.md.
Boundary markers: The skill enforces strict output formatting using predefined templates and structured JSON/Markdown schemas as detailed in references/output-formats.md and references/dashboard-schema.md.
Capability inventory: The skill executes local scripts via !uv run python and maintains a dedicated storage directory in ~/.claude/research/. A PreToolUse hook in SKILL.md explicitly blocks Edit operations to prevent data-driven instructions from modifying the user's workspace.
Sanitization: The scripts/finding-formatter.py utility employs html.escape to sanitize data when generating HTML-based dashboard outputs.
[COMMAND_EXECUTION]: The skill uses !uv run python to execute its internal utility scripts (journal-store.py, finding-formatter.py, etc.). These executions are limited to the skill's own local scripts and are used for data management and formatting, representing standard functionality for complex tools.
[DATA_EXPOSURE]: The scripts/journal-store.py script manages research journals in the user's home directory. Security is maintained through a strict containment check in the _resolve_path function, which prevents directory traversal by ensuring all file operations remain within the ~/.claude/research/ directory.

research