The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to fetch web content using a bash command template: curl -sL <url> | sed 's/<[^>]*>//g'. This creates a potential command injection surface if the agent interpolates a user-provided URL without sufficient sanitization or escaping, allowing an attacker to execute arbitrary commands via the shell.
[COMMAND_EXECUTION]: The workflow involves executing local shell and Python scripts (score.sh, rhythm.py). While these are intended functional components, their execution is triggered by user-initiated requests and operates on user-controlled data saved to /tmp/.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted text from external URLs and local files without applying protective boundary markers or instructions to ignore embedded commands.
Ingestion points: External text is ingested via the Bash tool (using curl), the WebFetch tool, and the Read tool.
Boundary markers: None. The instructions do not specify delimiters or constraints to prevent the agent from obeying instructions contained within the ingested text.
Capability inventory: The skill has access to Bash (command execution), Read (file access), WebFetch (network access), and the ability to write files to /tmp/.
Sanitization: The provided sed command removes HTML tags, but there is no mechanism to sanitize or filter the resulting text for malicious prompt injection instructions.

slop-check