The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites, which is an attack surface for indirect prompt injection.
Ingestion points: The scripts/crawl_site.py script fetches content from user-provided domains and returns the text to the agent for analysis.
Boundary markers: The instructions in SKILL.md do not provide delimiters or specific guidelines for the agent to distinguish between the crawled content and its own instructions.
Capability inventory: The skill uses bash_tool to execute shell commands and has the ability to write audit reports to /mnt/user-data/outputs/.
Sanitization: There is no evidence of sanitization, filtering, or instruction-blocking applied to the retrieved web content before it enters the agent's context.
[COMMAND_EXECUTION]: The skill instructions direct the agent to use bash_tool to run curl commands and execute the scripts/crawl_site.py script. This is consistent with the primary purpose of auditing site content.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch content from external domains. While this is the intended behavior for a crawler, it involves interactions with untrusted remote servers determined by user input at runtime.

adsense-audit