The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by ingesting data from an external service and interpolating it into prompts without sanitization.
Ingestion points: The skill reads response fields (e.g., message, issue) from https://isitagentready.com/api/scan and uses them to populate report templates and fix prompts.
Boundary markers: No explicit boundary markers or delimiters are used to wrap the untrusted API data, which could allow a malicious response to influence agent behavior.
Capability inventory: The skill uses curl for network requests and generates implementation prompts meant to be executed in subsequent interactions.
Sanitization: The skill lacks validation or escaping for the data received from the external API.
[DATA_EXFILTRATION]: The skill sends user-provided domain names to a third-party API at isitagentready.com. While this is the primary purpose of the skill, the destination is not in the recognized whitelist of trusted domains.
[COMMAND_EXECUTION]: The skill uses curl with specific headers and a custom User-Agent string to interact with the remote scanner API. While documented, this involves executing shell commands to transmit data to an external server.

agent-ready-cloudflare