The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using user-provided URLs (e.g., reader "$ARTICLE_URL", curl -s "$ARTICLE_URL"). Although variables are quoted, malformed URLs or specific shell configurations could potentially lead to command injection if the agent does not properly sanitize the input before passing it to the Bash tool.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted data from arbitrary external websites.
Ingestion points: Data enters the system via curl, reader, or trafilatura from user-supplied URLs in SKILL.md.
Boundary markers: The skill does not implement specific delimiters or warnings to the agent that the extracted content might contain malicious instructions.
Capability inventory: The skill has the capability to write to the local filesystem (Write tool, mv command) and execute shell commands (Bash tool).
Sanitization: While it removes HTML tags and cleans filenames, it does not sanitize the textual content against embedded prompt instructions.
[EXTERNAL_DOWNLOADS]: The skill recommends the installation of external packages such as @mozilla/readability-cli, reader-cli (NPM), and trafilatura (PyPI). These are well-known tools from established registries, but their installation introduces external dependencies into the environment.

article