The Agent Skills Directory

[DATA_EXFILTRATION]: The fetch_html function in scripts/export_chatgpt.py passes the user-provided URL directly to urllib.request.urlopen without validating the scheme or domain. An attacker could provide a file:// URI to read sensitive local files (e.g., file:///etc/passwd) or access internal network resources that the agent's environment can reach.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external URLs and renders it into Markdown or JSON without any sanitization or the use of boundary markers. If the agent later reads this exported content, it could be manipulated by malicious instructions embedded within the chat history.
Ingestion points: scripts/export_chatgpt.py via the fetch_html function.
Boundary markers: Absent; the output formats (render_markdown and render_json) do not use delimiters or warnings to separate external data from system instructions.
Capability inventory: The skill can fetch arbitrary network resources and write to the local file system via the --out argument.
Sanitization: None; the script extracts text parts from the JSON payload and writes them directly to the output stream or file.

export-chatgpt