The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill extensively fetches data from external platforms including Instagram, TikTok, Facebook, YouTube, and Google Maps using specialized MCP tools (Social Toolkit and SearchAPI). It also scrapes content from arbitrary URLs provided by the user using Firecrawl.
[COMMAND_EXECUTION]: The skill utilizes the infsh CLI for image generation and performs environment checks using which infsh. It also instructs the agent to execute deployment and preview commands such as npm run build and open index.html.
[DATA_EXFILTRATION]: The skill processes sensitive personal documents, specifically CVs and resumes, to extract expertise and career history. While this is for the purpose of generating a professional profile, it involves the ingestion and processing of private data into the AI context.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted text from across the web (social media bios, YouTube comments, website content) and uses it to generate landing page code and image prompts.
Ingestion points: Data fetched via FetchInstagramProfileTool, FetchTiktokProfileTool, FetchYoutubeCommentsTool, FirecrawlScrapeTool, and reading local CV files.
Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or ignore instructions found within the scraped content.
Capability inventory: The skill can generate and write HTML, CSS, and React code, and it can execute shell commands via the infsh CLI.
Sanitization: There is no mention of sanitizing or escaping the retrieved text before it is interpolated into the design analysis or code generation prompts.

landing-page