The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and interprets external scan reports from Blockquote.io, which involves processing untrusted data.
Ingestion points: Data retrieved from the compare_scans MCP tool and the https://blockquote.io/api/v1/compare REST API endpoint.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to encapsulate the retrieved report data within the agent's context.
Capability inventory: The skill utilizes tool execution (compare_scans) and network operations (curl) to fetch data, which the agent then interprets and reports.
Sanitization: There are no explicit instructions for sanitizing or validating the content of the external reports before processing.
[DATA_EXFILTRATION]: The skill performs network operations to fetch comparison data from a specific external domain.
Network operations: The skill utilizes curl and a remote MCP tool to access https://blockquote.io and https://mcp.blockquote.io.
Sensitive file access: No sensitive local file access was detected. The network activity is limited to the skill's primary functional purpose.
[CREDENTIALS_UNSAFE]: The skill mentions the use of API keys but explicitly defines secure handling practices.
Evidence: It advises: "Keep keys in the client's credential store or environment. Never put keys in shared commands." It uses a safe placeholder bq_… for demonstration purposes.

report-comparison