The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the Google PageSpeed Insights and Chrome UX Report (CrUX) APIs to fetch performance metrics. These are official services provided by a trusted organization.
[COMMAND_EXECUTION]: Instructions include shell commands that use curl to query APIs and python3 to parse the resulting JSON data. The Python code is a static, hardcoded parsing script provided within the skill for data extraction, not an external script being downloaded.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests data from external URLs and API responses.
Ingestion points: curl commands in SKILL.md are used to fetch content from user-provided URLs and API endpoints.
Boundary markers: Absent; the skill relies on the structured nature of the API responses (JSON) or specific pattern matching (grep).
Capability inventory: The skill uses curl, grep, and python3 for network operations and data processing.
Sanitization: The fetched data is processed through specific Python parsing logic or grep filters, which reduces the risk of arbitrary instruction execution by focusing on specific data fields (e.g., performance percentiles).
[REMOTE_CODE_EXECUTION]: While the skill contains patterns where curl output is piped to python3, these are diagnostic tools targeting trusted Google APIs. The Python logic is local and static, used solely to transform JSON output into readable text, which is standard behavior for technical diagnostic agents.

core-web-vitals