The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow defined in references/backlink-hunter.md (Step 3) instructs the agent to run curl commands using URLs extracted directly from untrusted third-party HTML. There is no instruction to escape or sanitize these URLs, creating a risk of command injection if a malicious site provides a crafted URL containing shell metacharacters (e.g., ;, &, |).
[PROMPT_INJECTION]: The skill exhibits a high surface for Indirect Prompt Injection in references/backlink-hunter.md.
Ingestion points: The agent is instructed to fetch full HTML content from arbitrary resource pages discovered via web search.
Boundary markers: The prompts in Step 4 (matching content) and Step 6 (drafting emails) lack delimiters or instructions to ignore embedded commands within the fetched HTML.
Capability inventory: The agent has the capability to execute shell commands (curl) and send outreach emails.
Sanitization: No validation or filtering is performed on the ingested content before it is processed by the LLM or used in shell commands.
[EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions to install additional functional components using python scripts/install-external-skills.py --skill browserbase-search. This facilitates the download and execution of external code from a registry at runtime.
[DATA_EXFILTRATION]: The automated outreach mechanism in references/backlink-hunter.md Step 7 involves sending emails to addresses found on the web. In conjunction with the indirect prompt injection vulnerability, an attacker could potentially influence the email content or recipient to facilitate unauthorized data transfer or phishing campaigns.

seo-competitor-gap