The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Skool communities (posts, comments, and search results) while also possessing write capabilities (creating posts, replying, and liking content). This creates a surface for indirect prompt injection, where malicious instructions hidden in a community post could attempt to influence the agent's behavior.
Ingestion points: scripts/skool_scraper.py, scripts/skool_unreads.py, and scripts/skool_comment_scraper.py ingest content from the Skool platform.
Boundary markers: Safety instructions requiring user approval for write operations are present in SKILL.md, but the scripts do not implement programmatic delimiters or sanitization for ingested text.
Capability inventory: The skill has network access for API interactions (read/write) and can write results to the local file system (JSON output).
Sanitization: No explicit sanitization or filtering of the community-sourced text is observed before it is presented to the agent.
[DYNAMIC_EXECUTION]: Scripts such as scripts/skool_browser_client.py and scripts/skool_comment_scraper.py use Playwright's page.evaluate method to execute JavaScript within a browser environment to bypass WAF protections. In scripts/skool_comment_scraper.py, the post_id is interpolated directly into a JavaScript string used for a fetch request. If the post_id (sourced from external community data) contains malicious characters, it could potentially lead to JavaScript injection within the headless browser context.

skool-monitor