The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill depends on browser39, a binary hosted in a personal GitHub repository (https://github.com/alejandroqh/browser39/releases). The author of the binary is not a recognized trusted vendor, and executing third-party binaries poses a significant security risk to the host environment.
[COMMAND_EXECUTION]: The workflow relies on constructing complex shell commands and Python scripts using variables derived from external, potentially malicious sources (URLs, domains, and paths).
Evidence: The use of mkdir -p docs/web/TARGET_DOMAIN/TARGET_PATH_DIR and open('docs/web/TARGET_DOMAIN/TARGET_PATH.md','w') within a python3 -c block creates a path traversal risk if the agent does not strictly sanitize the TARGET_DOMAIN and TARGET_PATH variables.
Evidence: Constructing the b39-cmd.jsonl file via echo with an unvalidated THE_URL string could lead to command injection if the URL contains shell metacharacters.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting, indexing, and presenting untrusted web content to the agent.
Ingestion points: Web content is fetched and saved to the local file system in docs/web/ (SKILL.md).
Boundary markers: None. The content is saved as raw markdown without delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has access to powerful tools including Bash, Write, and rm (SKILL.md frontmatter).
Sanitization: No sanitization, escaping, or validation is performed on the markdown content extracted from the web pages. Malicious instructions embedded in documentation or articles could be interpreted and executed by the agent when using the search or context tools.

web-research