The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from external URLs and local WXR files which are then processed by the agent in its content model.
Ingestion points: Origin URLs fetched via HTTP (Phase 2), WXR file content parsed from local storage (Phase 1).
Boundary markers: None identified; content is parsed and compared directly without explicit delimiters or 'ignore embedded instructions' warnings.
Capability inventory: The skill has access to Bash, Write, Edit, Read, Glob, and Grep tools.
Sanitization: No sanitization or filtering of external content is described before the agent processes it for comparison and grading.
[DATA_EXFILTRATION]: Potential Server-Side Request Forgery (SSRF). The skill automatically fetches content from URLs (_source_url) specified within the WXR file.
Evidence: 'Fetch the origin page via HTTP' in Phase 2 workflow.
Risk: A malicious WXR file could contain URLs pointing to sensitive internal network services or cloud metadata endpoints. The agent will fetch these resources, potentially exposing their contents in the comparison report or logs.
[COMMAND_EXECUTION]: Powerful Tool Access. The skill utilizes the Bash and Edit tools to perform content patching and environment resolution.
Evidence: allowed-tools includes Bash and Edit for workflow tasks like path resolution and WXR patching.
Risk: These tools provide the agent with significant control over the local environment, which increases the potential impact if the agent's behavior is influenced by malicious instructions embedded in the content being analyzed.

qa