The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external websites, which creates a significant surface for indirect prompt injection attacks.
Ingestion points: The skill uses curl in the SKILL.md workflow and the fetch API in fetch.ts to retrieve content from arbitrary user-provided URLs.
Boundary markers: The skill does not implement boundary markers or instructions to the agent to ignore potentially malicious directions embedded in the fetched content.
Capability inventory: The agent has access to shell commands (curl, bash), package management (bun install), and script execution (bun fetch.ts).
Sanitization: While the skill sanitizes content by removing script and style tags during HTML-to-Markdown conversion, it does not filter or sanitize natural language instructions that might attempt to manipulate the agent's behavior.
[DATA_EXFILTRATION]: The skill's primary function involves network operations to non-whitelisted domains using curl and the Node.js fetch API. This capability can be abused to perform Server-Side Request Forgery (SSRF) to probe internal network services or access cloud provider metadata endpoints (e.g., 169.254.169.254).
[COMMAND_EXECUTION]: The SKILL.md workflow passes a user-provided URL variable directly into a shell string: URL="<url>". If the input is not strictly validated by the agent before execution, it could lead to command injection if the URL contains shell metacharacters (e.g., backticks or $()).

web-fetch