The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to 'Replace KEYWORD with [user_input]' inside a Python one-liner execution (python3 -c "... keyword = 'KEYWORD'.lower() ..."). This pattern is vulnerable to command injection. If a user provides a keyword containing single quotes and Python code (e.g., AI'); import os; os.system('ls') #), the Python interpreter will execute the injected code because the input is not escaped or sanitized before being placed into the script string.
[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external, untrusted RSS/Atom feed URLs and returns titles and links directly to the agent's context. This presents an indirect prompt injection surface where a malicious feed could include hidden instructions intended to manipulate the AI agent's behavior.
Ingestion points: External RSS/Atom feeds fetched via curl in SKILL.md.
Boundary markers: None. The content is printed directly and returned to the agent.
Capability inventory: The agent has access to Bash, Read, and Write tools, meaning an injection could potentially lead to file modification or system commands.
Sanitization: Only basic .strip() is applied to the XML text; no sanitization or escaping of the content is performed before returning it to the agent.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged the use of curl | python3 as a remote code execution pattern. While the provided commands use python3 -c to execute a local hardcoded script that parses the remote data as XML rather than executing the data itself, the ingestion of arbitrary remote data into a processing pipeline still carries risk if the parser (ElementTree) is exploited via XML bombs or similar techniques.

rss-monitor