The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's network configuration explicitly disables private IP blocking (block_private_ips: false in SKILL.md). This allows the agent to reach internal network resources, loopback addresses, or cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data or credentials if the agent is running in a cloud-hosted environment.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its primary purpose is to ingest untrusted data from the internet.
Ingestion points: The url parameter allows fetching content from any attacker-controlled website.
Capability inventory: The skill performs network GET/POST requests and returns the response body directly to the agent's context (often after Markdown conversion in scripts/main.py).
Boundary markers: The script does not wrap the fetched content in protective delimiters or provide instructions to the agent to ignore potential commands embedded in the data.
Sanitization: While it uses html2text for formatting, it does not filter or sanitize the content for malicious natural language instructions designed to manipulate the agent.
[COMMAND_EXECUTION]: The skill implements a 'Legacy SSL' feature in scripts/main.py by manually setting the OP_LEGACY_SERVER_CONNECT flag (0x4) in the SSL context. This downgrades connection security by allowing unsafe legacy renegotiation, which increases vulnerability to certain Man-in-the-Middle attacks, although it is presented as a compatibility feature.

http-request