The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes untrusted content from external URLs which could be used to influence the agent's behavior during audit report generation.
Ingestion points: The scripts/check_schema_markup.py script fetches HTML and JSON-LD data from arbitrary URLs provided as input (line 26).
Boundary markers: No explicit delimiters or boundary markers (e.g., XML tags or triple quotes) are used in the script output or the templates/aeo-audit-report.md template to isolate external content from the agent's instructions.
Capability inventory: The skill has access to the Bash tool to run python scripts, and the agent uses the script's output to populate audit reports and make optimization recommendations.
Sanitization: The script extracts structured data using regex and JSON parsing but does not sanitize the content for natural language instructions before it is presented to the agent.
[EXTERNAL_DOWNLOADS]: External skill installation. The SKILL.md documentation includes commands to install additional tools (e.g., browserbase-search, unslop) using a local helper script scripts/install-external-skills.py. While the installation script is not provided in this package, the referenced services are well-known technology providers and the process is a standard part of the vendor's ecosystem functionality.

aeo