The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites and presents it to the agent, creating a potential attack surface.
Ingestion points: scripts/capture.mjs crawls live websites, and scripts/lib/extract.mjs parses the resulting HTML to extract fields like title, description, h1/h2/h3 headings, jsonLd, and visibleText.
Boundary markers: The skill does not implement boundary markers or instructions to the agent to treat the captured site data as untrusted or to ignore embedded instructions within the captured content.
Capability inventory: The agent is intended to use the captured data (inventory.json, README.md) to plan website conversions and rebuilds, which involves complex reasoning and potential code generation or file writing.
Sanitization: The extracted text fields are stored as raw strings in JSON and Markdown files without sanitization against potential instructions that might target the agent's logic.
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from remote origins specified by the user and historical data from the Wayback Machine.
Evidence: scripts/lib/wayback.mjs fetches archived URL lists from web.archive.org, which is a well-known service for historical web data.
The skill implements an SSRF (Server-Side Request Forgery) guard in scripts/lib/http.mjs via the isBlockedAddress function, which prevents requests to loopback, private, link-local, and cloud metadata IP addresses (e.g., 127.0.0.1, 169.254.169.254).

capture-site