The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to crawl and process content from external websites, creating a surface for indirect prompt injection attacks.
Ingestion points: Data is ingested from external websites via the browse/gstack tool and the scripts.audit.collect data collector script.
Boundary markers: The instructions do not provide boundary markers or explicit instructions to the agent to ignore potentially malicious instructions embedded in the crawled SEO data.
Capability inventory: The skill can execute local shell commands (python -m scripts.audit.collect) and write files to the workspace/ directory.
Sanitization: There is no evidence of sanitization or filtering applied to the external data before it is analyzed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to execute specific Python scripts to perform audit provenance checks and data collection.
Evidence: Phase 0.5 requires running python scripts/quality_gates/audit_provenance_lint.py and python -m scripts.audit.collect with user-supplied arguments.
[DATA_EXFILTRATION]: The skill's discovery phase encourages broad file system access, which could lead to sensitive information being read into the agent's context.
Evidence: Phase 0 instructions tell the agent to "Auto-explore the codebase... Read CLAUDE.md, README.md, PROJECT.md, package.json, landing pages, and any project files" to find "analytics config." This broad scope could inadvertently include credentials or private configuration data stored in project files.

kai-seo-audit