The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash commands to install tools, fetch content, and process data. It cleans filenames to prevent path traversal or shell errors, but uses variables like ARTICLE_URL directly in commands which could lead to command injection if the input URL is maliciously crafted and not sanitized by the platform.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external packages such as trafilatura and @mozilla/readability-cli (a Mozilla-provided tool) and downloads content from arbitrary URLs provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted text content from external websites. An attacker could embed instructions in an article to manipulate the agent's behavior when it extracts and displays the text.
Ingestion points: Content is fetched from user-provided URLs in SKILL.md via tools like curl, reader, and trafilatura.
Boundary markers: Absent. The extracted content is saved to the filesystem and previewed directly to the agent's context without isolation.
Capability inventory: Access to Bash (command execution) and Write (file manipulation) tools allows the agent to take actions that could be influenced by malicious content in the extracted text.
Sanitization: No sanitization is performed on the extracted article body, although filenames are cleaned for filesystem compatibility.

article-extractor