The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands, specifically curl -sI, to verify HTTP headers, redirects, status codes, and TLS configurations on the target domain.- [INDIRECT_PROMPT_INJECTION]: The agent is designed to fetch and process data from untrusted external sources, including website HTML, robots.txt, and XML sitemaps.
Ingestion points: External URLs provided by the user (found in SKILL.md and reference/checklist.md).
Boundary markers: None identified; there are no specific instructions to treat fetched content as data only or to ignore embedded instructions within HTML comments or text.
Capability inventory: Subprocess execution via shell (curl), network operations (HTTP/DNS), and file writing (generating audit reports).
Sanitization: None mentioned for the fetched content before processing or reporting.- [DATA_EXPOSURE]: The skill explicitly requests that the user provide access to sensitive environments to perform a complete audit, including Search Console, Google Analytics 4, CMS administration panels, hosting credentials, and test email accounts. While these are necessary for the primary purpose of the skill, they represent a significant exposure of sensitive information within the agent's context.

dido-checklist-sito-web