The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from arbitrary external URLs and feeds it directly into the agent's context to create action plans. This lack of isolation allows content from untrusted sources to potentially hijack the agent's instructions.
Ingestion points: Content is fetched from URLs using curl and yt-dlp in SKILL.md and passed to a subsequent planning step.
Boundary markers: None; the extracted text is processed without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill utilizes Bash, Read, and Write tools, enabling file system changes and command execution based on the generated plan.
Sanitization: Performs basic cleanup of HTML and VTT tags, but lacks semantic filtering to detect or block prompt injection attempts.
[EXTERNAL_DOWNLOADS]: The skill manages the installation of external dependencies and fetches remote content.
The script executes brew install yt-dlp to install the YouTube downloader if it is not present.
It downloads arbitrary files (PDFs) and transcripts from external servers using curl and yt-dlp.
[COMMAND_EXECUTION]: The skill relies on complex Bash shell scripts to handle external inputs and orchestrate the extraction workflow.
User-provided URLs are passed as arguments to CLI tools including curl, yt-dlp, reader, and trafilatura within SKILL.md.
While inputs are quoted, the use of shell execution for processing external data increases the potential attack surface.

tapestry