The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes untrusted content from external websites.
Ingestion points: The WebFetch tool is used to retrieve data from a user-provided URL and up to 50 crawled subpages (SKILL.md, Phase 1).
Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" guards when passing fetched content to the subagents for analysis.
Capability inventory: The agent is granted Bash, WebFetch, and Write capabilities, which could be targeted by an injection attack.
Sanitization: There is no mention of sanitizing or filtering the HTML content before it is processed by the subagents.
[COMMAND_EXECUTION]: The skill's configuration includes Bash in the allowed-tools list. While the current instructions focus on analytical tasks, the availability of a shell environment alongside the ingestion of untrusted web data increases the potential impact of a successful indirect prompt injection attack.

geo-audit