The Agent Skills Directory

[DATA_EXPOSURE]: The skill retrieves SEO search data and host information from Yandex's official API. The implementation includes a security measure to redact the $YANDEXWEBMASTER_ACCESS_TOKEN from error messages, preventing the token from being exposed in logs or agent responses if a request fails.
[EXTERNAL_DOWNLOADS]: The skill communicates with well-known search engine infrastructure at api.webmaster.yandex.net. These operations are limited to authenticated read-only GET requests for search statistics.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Data is ingested via scripts/yandex_webmaster.py from Yandex API responses.
Boundary markers: The script does not use explicit boundary markers in its output.
Capability inventory: The skill only possesses the capability to print JSON data to standard output. It has no capabilities for file writing, arbitrary command execution, or further network requests based on the fetched data.
Sanitization: All output is sanitized through json.dumps ensuring data is treated as a string literal and not as instructions.
[DYNAMIC_EXECUTION]: The unit tests use importlib to load the local script for testing purposes. This is a standard development practice for isolated testing and does not involve executing untrusted or remote code.

yandex-webmaster